Passkey attacks bypass Microsoft and Google defenses: keys recovered, MFA circumvented

Three separate research efforts published last week demonstrated ways to bypass passkey protections without breaking the underlying cryptography. The attacks did not crack the math but exploited implementation flaws, raising questions about the technology's reliability as a password replacement.

Researchers at SpecterOps identified a chain of vulnerabilities in Windows and Microsoft Entra ID that allows impersonating privileged users while satisfying phishing-resistant multifactor authentication (MFA) requirements. Instead of stealing the authenticator's private key, the attack reused signed authentication material that Windows had left accessible.

Unit 42 researchers demonstrated attacks against Google Password Manager in Chrome, including a path that recovers the private keys for a victim's synced passkeys. Independent researcher Dirk-jan Mollema showed that malware already running in a signed-in Windows session can use a hardware-bound Windows Hello for Business key without prompting the user to unlock it again with a PIN or biometric check.

The impact varies across the three cases. The Windows Event Logging vulnerability, tracked as CVE-2026-34348, received a CVSS score of 6.5 from Microsoft, and a security update has been released. A Microsoft spokesperson said the company also applied mitigations for the reported issue involving passkey relay assertions but did not disclose technical details about the scope of the separate Entra-side measures.

In a statement to The Hacker News, a Microsoft spokesperson said: "We appreciate the work of SpecterOps for reporting this through a coordinated vulnerability disclosure. We have applied mitigations for the reported issue involving passkey relay assertions and continue investing in security enhancements across authentication methods. We recommend adopting a least-privilege access approach, using phishing-resistant authentication methods, and maintaining endpoint protections by embracing a Zero Trust security model to be better protected."

Microsoft's Entra migration guidance, last updated August 3, 2026, still describes passkeys as resistant to replay attacks. However, the findings from Unit 42 and Mollema show that choosing between synced and device-bound passkeys alone does not close the broader attack surface. Each option has its own weaknesses, and protection requires a comprehensive approach.