Pass-the-Passkey Bypasses MFA Without Breaking FIDO2

I have spent years arguing that passkeys are the right answer to phishing. The cryptography behind that argument is still sound. Research presented at Black Hat USA 2026 does not change it. What it changes is the assumption that deploying passkeys closes the authentication attack surface. It does not. The weakness is not in FIDO2. It is in everything built around it.

Michael Grafnetter, a principal researcher at SpecterOps, presented a family of more than 20 techniques he named Pass-the-Passkey, echoing Pass-the-Hash and NTLM Relay. None of them extract a private key from a hardware module. All of them can still produce a privileged sign-in. Two other August disclosures sit next to that talk, not inside it: Unit 42's work on Google Password Manager in Chrome, and Dirk-jan Mollema's work on Windows Hello for Business. Collapsing the three into one bug would go beyond what the sources support.

Three research tracks, not one bug

SpecterOps' whitepaper, presented August 5, is the Windows and Entra ID chain. Windows stored past YubiKey signatures in cleartext in event logs, readable by authenticated unprivileged users, including remote ones. The flaw is CVE-2026-34348, an information-disclosure issue in the Windows Event Logging Service, vendor-rated CVSS 6.5. SpecterOps says Entra ID then accepted those retained signatures in a replay chain, which could impersonate a privileged user while satisfying a phishing-resistant MFA policy. The private key never left the authenticator. The dangerous material was a signature Windows had already made and kept.

Microsoft issued a security update for the logging bug. SpecterOps told The Hacker News that July 2026 Windows updates made the logged assertions unusable for replay, and that it now considers the full Windows-to-Entra chain broken. As of August 10 it had not retested Entra's own challenge handling since June. The firm says Entra still uses JWTs as WebAuthn challenges rather than single-use random nonces, and does not bind those challenges to session cookies, a control it says GitHub uses. Microsoft told The Hacker News it applied mitigations for passkey relay assertions and continues to recommend phishing-resistant methods under a Zero Trust model.

Unit 42's separate work, which it calls Pass-ta-key, targets Google Password Manager's synced passkeys in Chrome on Windows. All three of its paths start with malware already on the endpoint, without needing an administrator escalation. The most damaging variant, Golden Pass-ta-key, goes after the Security Domain Secret, a 32-byte master key that protects synced passkeys. Unit 42 first found that secret in Chrome device logging. Google removed it from logs after the report. The researchers say it is still briefly present in process memory during re-registration, and that with it an attacker can recover the victim's synced passkey private keys. Unit 42 also says Google's implementation currently has no way to rotate or revoke that secret.

Mollema's research is the third track. On most modern Windows devices, the Windows Hello for Business key lives in the TPM and cannot be exported. He showed that a low-privilege process inside an already signed-in session can use that key as a FIDO2 credential against Entra ID without a fresh PIN or biometric prompt. Entra's WebAuthn challenge, in his testing, was valid for five minutes and not bound to a session, user, or tenant. A challenge minted on an attacker's machine can be signed on the victim's machine and returned as a valid assertion. SpecterOps notes that Mollema's method uses the same Entra challenges but operates lower in the stack, at the certificate level, and only against Entra passkeys protected by Windows Hello for Business.

This does not undo passkeys

None of these techniques defeat what passkeys were designed to defeat. Phishing, the dominant real-world credential attack, remains blocked by FIDO2's origin-bound design. An attacker cannot trick a user into approving a passkey assertion on a fake login page the way they can trick a user into typing a password. Remote, unauthenticated theft of a private key at internet scale remains structurally impossible against a correctly implemented passkey.

What Pass-the-Passkey shows is a familiar lesson. An attacker who already has local code execution or a live session can abuse unlocked authentication material. That is the same class of problem Pass-the-Hash exploited for a decade in Windows environments. It is serious. It is not phishing. Mixing the two leads teams either to freeze passkey rollouts or to treat endpoint compromise as irrelevant. Both are wrong.

Authentication is a system property

I built LoginRadius from 2013 to more than a billion users. The hardest lesson in that work was that a sound protocol is necessary and never sufficient. Authentication security spans the protocol, the client, server-side validation, session handling, and the endpoint where the material lives. A hole at any layer can undo guarantees the protocol itself keeps perfectly.

FIDO2 and WebAuthn solved the hard part: proving possession of a private key without that key being transmittable. The surrounding parts are unfinished. Server-side assertion validation is not uniformly airtight. Endpoint logging can retain reusable signatures. An already-authenticated session can be silently reused by malware to mint fresh assertions. Microsoft is raising the stakes on getting those details right. Starting September 1, 2026, Entra ID users enabled for SMS or voice will be auto-enabled for passkeys. Microsoft-provided SMS and voice delivery is scheduled to retire on February 1, 2027.

That migration is still the right move. Pair it with the endpoint and session work the protocol cannot do for you. The device-bound versus synced passkey decision is part of that pairing. Unit 42 and Mollema both show why neither choice, on its own, closes the rest of the chain.

What organizations should do

Patch CVE-2026-34348. Install Microsoft's updates for the Windows Event Logging issue. SpecterOps considers the replay chain closed on the Windows side after the July updates. Treat any remaining Entra challenge-handling questions as a monitoring problem, not as a reason to skip the patch.

Do not treat passkeys as a substitute for endpoint security. The most serious demonstrated chains start with malware already in a signed-in session. EDR, application allowlisting, and zero trust session checks still matter in a passwordless estate. Passkeys eliminate phishing. They do not eliminate the value of a compromised endpoint.

Audit your own WebAuthn assertion validation. Check origin, challenge freshness, user-verification flags you requested, and signature counters. SpecterOps also found a major cloud service vulnerable to the class of attack passkeys were meant to prevent. Assume that gap is more common than the marketing implies.

Review where you store authentication artefacts. Cleartext YubiKey signatures readable by unprivileged, even remote, users is a basic access-control failure. Signatures, assertions, and session tokens deserve the same handling as password hashes.

Keep the rollout going. Watch Windows Hello for Business authentications that lack a device identifier, and unexpected device registrations, which Mollema flagged as a persistence path. The residual risk is endpoint compromise and session reuse. That is what a complete FIDO2 architecture still has to cover.

Key takeaways

• SpecterOps' Michael Grafnetter presented more than 20 Pass-the-Passkey techniques at Black Hat USA 2026 on August 5. They do not break FIDO2 cryptography.
• CVE-2026-34348 is a Windows Event Logging information-disclosure bug, CVSS 6.5. July 2026 updates made logged assertions unusable for the Windows-to-Entra replay chain, according to SpecterOps.
• Unit 42 showed malware on a Windows endpoint recovering synced passkey private keys from Google Password Manager via Chrome's Security Domain Secret.
• Dirk-jan Mollema showed malware in a signed-in session using a Windows Hello for Business key against Entra ID without a fresh PIN or biometric.
• Passkeys still stop phishing and remote credential theft. This research is about prior endpoint or session compromise.
• Microsoft mitigated the disclosed logging issue, applied relay-assertion mitigations, and continues to recommend passkeys. Entra auto-enables them for SMS and voice users from September 1, 2026.
• Patch, keep endpoint security, audit your own assertion validation, and continue the passkey rollout.

Frequently Asked Questions

Do Pass-the-Passkey attacks break FIDO2?

No. None of the three research tracks extract a hardware-bound private key by breaking the cryptography. They reuse signatures Windows retained, abuse synced-key recovery after malware is already on the device, or ask already-unlocked hardware to sign a challenge.

Should we pause passkey rollouts?

No. Passkeys remain the strongest widely deployed answer to phishing. Pausing leaves passwords in place, which is the attack that actually scales. Pair the rollout with endpoint detection and assertion-validation hygiene.

Is a hardware security key enough?

A hardware key still beats a synced software passkey against remote theft of the private key. It does not help if Windows logs a reusable signature, or if malware in the user's session can invoke Windows Hello without a fresh prompt. Hardware is necessary. It is not the whole control set.

What is CVE-2026-34348?

An information-disclosure vulnerability in the Windows Event Logging Service. Microsoft rated it 6.5. Affected products span Windows 10, Windows 11, and Windows Server. The CVE describes the logging issue. It does not, by itself, prove the full passkey impersonation chain on every listed release.

Synced or device-bound passkeys?

Neither choice closes this research by itself. Synced passkeys create a recovery secret worth stealing, which is Unit 42's finding. Device-bound keys can still be invoked from a live compromised session, which is Mollema's finding. Pick based on threat model, then monitor the session.

Related reading

• Device-bound vs synced passkeys: the migration choice this research now informs
• Passkeys vs passwords: what passkeys still win, unambiguously
• FIDO2 implementation guide: the protocol layer these attacks sit around, not inside