The article describes a straightforward phishing attack that works specifically against accounts that are _not_ protected by passkeys:
> Depending on which multi factor method the account uses, the victim sees a matching fake screen, whether a one time code prompt, an authenticator app number match, or an SMS page.
The only sense in which passkeys have anything to do with this at all is that the attackers used the word "passkey" in their emails. When a phishing campaign with the subject line "Your Mailbox is Full, Log In to Fix Now!" succeeds, that does not demonstrate an interesting vulnerability inherent to your mail server's mailbox size limits.
In this attack, it sounds like the key step was that the user entered their username and password, thinking they were preparing to enter a passkey. It wasn't the passkey system itself (which would prevent this attack), it was the transition from password → passkey system that was attacked.
In any case, if you can get the user on the phone and convince them to let you walk them through a bespoke auth flow, I doubt there is any auth mechanism that would stop this. This is why every auth system these days is constantly telling you "We'll never ask for X", because at that point, the game is over.
> In any case, if you can get the user on the phone and convince them to let you walk them through a bespoke auth flow, I doubt there is any auth mechanism that would stop this.
Exactly. Passkeys can't solve the problem of phishing. At best it only makes it more difficult. Phishing is less of a concern to me personally than losing my access to my account because of the complexity and fragility of passkeys. I've read enough horror stories, even from very capable people, about people who were screwed because they thought they were doing the right thing by setting up passkeys. Passkeys sound like they might be great for many other people. My vulnerability to phishing doesn't justify the risk of passkeys.
That's like saying that there's nothing wrong with passwords, it's a bug in the human that can't tell the difference between their bank's website and some random web form with their banks logo slapped on it created on wix.com
Attacks on passkeys have been because of flaws in the OS, or the browser, or the password manager, but none of those things are going away any time soon. Passkeys depend on those things, which means they aren't are solution to the problem of phishing. They just make phishing harder.
Passkeys also make things harder for the legitimate user though, and there's a very real question of whether the protection they offer is worth the trouble.
Probably something like this https://cybersecuritynews.com/hackers-abuse-microsoft-entra-...
The article describes a straightforward phishing attack that works specifically against accounts that are _not_ protected by passkeys:
> Depending on which multi factor method the account uses, the victim sees a matching fake screen, whether a one time code prompt, an authenticator app number match, or an SMS page.
The only sense in which passkeys have anything to do with this at all is that the attackers used the word "passkey" in their emails. When a phishing campaign with the subject line "Your Mailbox is Full, Log In to Fix Now!" succeeds, that does not demonstrate an interesting vulnerability inherent to your mail server's mailbox size limits.
> The only sense in which passkeys have anything to do with this at all is that the attackers used the word "passkey" in their emails.
That's wrong. They attackers actually go on to create a real passkey that gives their device access to the compromised account.
Accounts that are already protected by passkeys can still be vulnerable too. see:
https://www.forbes.com/sites/zakdoffman/2025/08/28/yes-your-...
https://www.esentire.com/blog/securing-passkeys-thwarting-au...
https://unit42.paloaltonetworks.com/passwordless-authenticat...
3 replies →
In this attack, it sounds like the key step was that the user entered their username and password, thinking they were preparing to enter a passkey. It wasn't the passkey system itself (which would prevent this attack), it was the transition from password → passkey system that was attacked.
In any case, if you can get the user on the phone and convince them to let you walk them through a bespoke auth flow, I doubt there is any auth mechanism that would stop this. This is why every auth system these days is constantly telling you "We'll never ask for X", because at that point, the game is over.
> In any case, if you can get the user on the phone and convince them to let you walk them through a bespoke auth flow, I doubt there is any auth mechanism that would stop this.
Exactly. Passkeys can't solve the problem of phishing. At best it only makes it more difficult. Phishing is less of a concern to me personally than losing my access to my account because of the complexity and fragility of passkeys. I've read enough horror stories, even from very capable people, about people who were screwed because they thought they were doing the right thing by setting up passkeys. Passkeys sound like they might be great for many other people. My vulnerability to phishing doesn't justify the risk of passkeys.
1 reply →
Isn’t that a bug in the Microsoft software, not the pass key specification?
That's like saying that there's nothing wrong with passwords, it's a bug in the human that can't tell the difference between their bank's website and some random web form with their banks logo slapped on it created on wix.com
Attacks on passkeys have been because of flaws in the OS, or the browser, or the password manager, but none of those things are going away any time soon. Passkeys depend on those things, which means they aren't are solution to the problem of phishing. They just make phishing harder.
Passkeys also make things harder for the legitimate user though, and there's a very real question of whether the protection they offer is worth the trouble.
1 reply →