Passkeys have been hailed as the most significant leap forward in authentication security in decades — and for good reason. But as adoption explodes worldwide, a wave of new research is exposing critical vulnerabilities that every security professional, IT administrator, and everyday user needs to understand. The promise of passwordless authentication is real, but so are its attack surfaces. Here's what you need to know right now.
The Passkey Revolution Is Here — And It's Moving Fast
The numbers tell a compelling story.
The FIDO Alliance's State of Passkeys 2026 report estimates 5 billion passkeys now in active use, with 90% consumer awareness and 75% of people having enabled a passkey on at least one account.
On the enterprise side,
68% of surveyed organisations have deployed or are actively deploying passkeys for workforce sign-in, with the strongest momentum in the United States and United Kingdom.
The momentum is undeniable.
Microsoft has announced that starting September 1, passkeys will become the default authentication method for Microsoft Entra ID sign-in, the tech giant's cloud-based identity and access management service.
Meanwhile,
48% of the top 100 websites now support passkeys.
But with scale comes scrutiny — and security researchers are now uncovering vulnerabilities that strike at the heart of what passkeys promised to deliver.
What Makes Passkeys Fundamentally Stronger Than Passwords
Before diving into the risks, it's worth understanding why passkeys generated such excitement in the first place.
Passkeys represent the most promising realisation of passwordless authentication — a discoverable WebAuthn credential synchronised across a user's devices via encrypted cloud storage, enabling seamless multi-device login without passwords.
They are considered safer than passwords because they cannot be guessed, reused, or easily stolen through phishing, while also allowing users to authenticate with a PIN or biometrics, such as a fingerprint or facial recognition.
Crucially,
passkeys are bound to a website domain — unlike passwords, which people tend to reuse across all their digital accounts. This means that email-based phishing attacks that lure users to domains with replica websites are thwarted, as the passkey will simply not work.
These are genuine, meaningful security advantages. The problem is that attackers aren't trying to break the cryptography — they're going around it entirely.
The Pass-ta-Key Attacks: A New Threat Class Arrives
In August 2026, researchers at Palo Alto Networks' Unit 42 published findings that sent shockwaves through the security community.
Researchers identified three attack techniques — Pass-ta-key, Silver Pass-ta-key, and Golden Pass-ta-key — that target different components of Google Password Manager's synchronised passkey architecture. Rather than breaking cryptography, the attacks exploit weaknesses in device verification, passkey synchronisation, recovery, and re-registration processes.
What makes these attacks particularly alarming is their low barrier to execution.
All three attacks require malware to already be running on the victim's computer and do not break the cryptography used by passkeys. Instead, they exploit weaknesses in how Chrome and Google's cloud authenticator handle device trust, onboarding, recovery, and synced credentials.
Here's what each attack does in practice:
- Pass-ta-key:
Allows unprivileged malware to impersonate a trusted device and request a valid authentication response for one of the victim's passkeys. The malware abuses Chrome's TPM-backed device identity key to sign a request sent to Google's cloud authenticator — and this can be done without administrator privileges, user interaction, biometrics, or unlocking the device.
- Silver Pass-ta-key:
An attacker deceives the Google Cloud Authenticator into believing the victim has unlocked the device with biometrics, leading to full account takeover without using the victim's device during authentication.
- Golden Pass-ta-key:
An attacker can extract all synced passkeys in a form that allows them to be shared or sold on the credential black market.
This is a paradigm shift. Attackers are no longer after your password. They're after your device trust.
Windows and Microsoft Entra ID Are Also Under Fire
The Google ecosystem isn't the only target. Concurrent research by SpecterOps principal security researcher Michael Grafnetter uncovered vulnerabilities in Microsoft's own passkey implementation.
That research uncovered three nearly exploitable zero-day vulnerabilities in Windows 11 and Microsoft Entra ID. Two of the vulnerabilities formed a replay chain that could eventually allow attackers to impersonate privileged cloud identities while bypassing phishing-resistant multifactor authentication.
Grafnetter himself acknowledges that "passkeys are still a major improvement over passwords, but they are not magic," noting that "if the surrounding implementation is flawed, attackers can still reintroduce replay, relay, and phishing-like attack paths even when the underlying WebAuthn cryptography is sound."
The core message is consistent across all of this research:
the main risk is not the standard itself but incomplete or incorrect implementations.
Session Hijacking: The Attack Vector That Passkeys Cannot Stop
Beyond implementation flaws, there's a broader class of attack that passkeys simply weren't designed to prevent.
The main exposures are session hijacking, where an attacker replays a stolen session cookie to resume an authenticated session after the passkey has done its job, and account recovery methods, which criminals increasingly target because recovery flows often fall back to weaker verification than the passkey itself.
The scale of this threat is growing fast.
Attackers are intensifying their phishing and credential theft methods, which drive 37% of successful intrusions, and there has been an exponential rise in cookie and authentication token theft as a preferred method — with an 84% increase in email-delivered infostealers in 2024 compared to the previous year.
In other words, even if your login is perfectly secure, the session that follows can still be compromised. Passkeys seal the front door while criminals learn to use the window.
Practical Tips: How to Protect Yourself Right Now
Understanding the risks is only half the battle. Here's what you can do immediately to harden your passkey security posture:
- Prioritise device security above all else.
Endpoint compromise remains a critical part of the threat model. When authentication decisions rely on signals from the user's device, an attacker with access to that device can manipulate those signals in ways that are difficult to detect.
Keep your OS, browser, and endpoint security tools fully updated.
- Harden your account recovery flows.
Review recovery and device binding first, because those are common places where attackers reintroduce fraud. Many security teams encounter takeovers only after recovery abuse or device re-enrolment has already been used to reissue trust.
- Don't rely solely on passkeys.
Passkey deployments should be treated as one layer in a broader security strategy.
Layer adaptive MFA, device intelligence, and behavioural analytics on top.
- Be cautious with browser-synced passkeys for high-risk accounts.
Security experts suggest that "much like passwords in web browsers have long been at risk, we must now consider passkeys in the browsers an unacceptable risk"
for highly sensitive access — consider hardware-backed alternatives such as FIDO2 security keys for privileged accounts.
- Separate passkey policy by assurance level.
Classify where syncable passkeys are acceptable and where device-bound or stronger recovery controls are required.
- Monitor for post-authentication threats.
Tie authentication design to fraud telemetry — use login success rates, account takeover attempts, and help-desk recovery volume to judge whether passkey rollout is reducing risk or simply shifting it.
- Use well-tested WebAuthn frameworks.
Developers should rely on well-tested WebAuthn frameworks rather than build their own, since passkey validation involves nontrivial cryptography.
The Bigger Picture: Passkeys Are Still Worth It
None of this should be read as a reason to abandon passkeys.
As researchers themselves acknowledge, "the attack paths we describe remain much more complex than those in traditional password attacks, so we continue to recommend adopting passkeys."
The vulnerabilities exposed require malware to already be running on the victim's device — a significant prerequisite — and they are being actively disclosed to platform providers for remediation.
Hardware-backed keys, secure enclaves, and cloud isolation significantly raise the bar, but they do not fully eliminate this risk.
The goal isn't perfection — it's a meaningfully higher security baseline than the password era ever provided.
Conclusion: Evolve Your Strategy Before Attackers Exploit the Gap
Passkeys represent a genuine and transformative improvement over traditional password-based authentication. But the research is clear: they are not a silver bullet. Treating passwordless authentication as a complete solution — rather than one critical layer in a defence-in-depth strategy — is precisely the kind of overconfidence that attackers are counting on.
The time to act is now. Audit your account recovery flows, invest in endpoint protection, monitor for session hijacking, and ensure your passkey implementation follows industry-vetted frameworks. Whether you're an enterprise security team or an individual user, the gap between passkey adoption and passkey security hygiene is where the next wave of account takeovers will happen. Don't be a statistic — review your authentication strategy today, and if you need expert guidance on deploying passwordless authentication the right way, consult with a qualified identity security specialist before your organisation becomes the next case study.
