Researchers Bypass Passkeys, Recover Private Keys and Defeat MFA on Windows and Chrome
Updated
Updated · The Hacker News · Aug 10
Researchers Bypass Passkeys, Recover Private Keys and Defeat MFA on Windows and Chrome
3 articles · Updated · The Hacker News · Aug 10
Summary
Three research teams showed passkey attacks that did not break FIDO2 cryptography but still enabled account takeover by replaying signed material, extracting synced private keys, or using hardware-bound keys from compromised Windows sessions.
SpecterOps linked CVE-2026-34348 to a Windows and Entra ID chain in which cleartext YubiKey signatures stored in logs could be reused to impersonate privileged users while satisfying phishing-resistant MFA; Microsoft issued a Windows update and said it applied Entra mitigations.
Unit 42 targeted Google Password Manager in Chrome on Windows, showing malware could abuse synced passkeys and, in the worst case, use a 32-byte Security Domain Secret to recover victims' synced private keys; Google removed one logging exposure, but the secret can still appear briefly in memory.
Dirk-jan Mollema found malware in an already signed-in Windows session could use a TPM-backed Windows Hello for Business key without a new PIN or biometric check, then sign an Entra challenge valid for 5 minutes and satisfy Conditional Access.
The findings widen concern as Microsoft plans to auto-enable passkeys for Entra users on SMS or voice authentication from September 1, 2026, ahead of those methods' retirement on February 1, 2027.
If passkeys are unhackable, why can malware silently hijack your digital identity without ever stealing your password?
Can enterprise networks truly achieve Zero Trust if their phishing-resistant passkeys are quietly replayed by compromised endpoints?
Breaking the Passwordless Promise: Black Hat 2026 Reveals How Passkeys Were Compromised on Windows and Chrome
Overview
In August 2026, researchers revealed that passkeys—once seen as the future of secure authentication—can be bypassed on Windows and Chrome without breaking cryptography. Attackers exploited flaws in how Windows stored YubiKey signatures in cleartext, allowing them to replay these signatures and impersonate privileged users, bypassing even phishing-resistant MFA. On Chrome, malware could extract a master secret from memory, letting attackers decrypt all synced passkeys and maintain long-term access, with no way for users to revoke this secret. These findings show that, as Microsoft forces a rapid move to passkeys, real-world software weaknesses can undermine the promise of passwordless security.