Passkeys Raise the Bar. Here’s Where Attackers Can Still Get In.
Huntress says the EvilTokens device-code phishing kit hit 344 organizations without breaking passkey cryptography.
Huntress describes how attackers bypass the benefits of passkeys by abusing enrollment, recovery, endpoints, and alternate sign-in flows rather than breaking passkey cryptography. Researchers tracked EvilTokens, a phishing-as-a-service kit using AI-generated lures, which hit 344 organizations across five countries in about 16 days by abusing Microsoft's device-code flow to obtain valid sessions. A separate campaign used passkey-update lures while relying on non-phishing-resistant MFA. SpecterOps research also shows local malware can hook Windows WebAuthn interactions without extracting the private key.
- EvilTokens hit 344 organizations in five countries in about 16 days.
- Victims complete a real Microsoft device-code flow and hand over a valid session.
- Passkey-themed lures can push users toward weaker MFA or recovery paths.
- Local malware can hook WebAuthn handling without extracting the private key.
- Enrollment, recovery, endpoints, and identity detection still need monitoring.
- ATT&CK
- T1566.002 Spearphishing LinkT1528 Steal Application Access TokenT1656 ImpersonationT1078 Valid Accounts
- Products
- Windows
- Malware
- EvilTokens
- Organizations
- HuntressMicrosoftSpecterOps
From the original article
6 min read at huntress.comPasskeys significantly improve authentication, but attackers still target enrollment, recovery, endpoints, and alternative flows. Discover how to secure the full account lifecycle with a comprehensive identity strategy.
huntress.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.