Researchers Identify 39 Ways to Compromise Passkey Authentication

Security researchers, including the Unit 42 team at Palo Alto Networks, have documented 39 distinct methods and attack paths capable of compromising accounts protected by passkeys. The findings indicate that while passkeys effectively eliminate traditional phishing, they introduce a new set of vulnerabilities centered on endpoint security and ecosystem management.

According to the research, these 39 documented exploitation scenarios do not break the underlying FIDO2 cryptography. Instead, attackers bypass security by exploiting trust boundaries. These include the abuse of authentication prompts, the manipulation of enrollment and recovery workflows, and the targeting of synced credentials. Specifically, Unit 42 found that malware on a compromised endpoint can misuse device trust and onboarding workflows to take over accounts, which includes the extraction of synced private keys from ecosystems such as Google's.

The Shift from Secrets to Endpoints

Passkeys were designed to replace traditional passwords with public-key cryptography, binding credentials to specific services to prevent credential theft. By removing the shared secret—the password—the industry aimed to kill the phishing attack vector. However, as adoption increases, the attack surface has shifted. Rather than attempting to steal a password, attackers are now focusing on compromising the endpoint device or the cloud-based sync provider (such as Apple, Google, or Microsoft) that manages the keys.

Implications for Security Models

This research challenges the prevailing perception of passkeys as a "silver bullet" for authentication. The findings demonstrate that the risk has not been eliminated but rather relocated to the trust models of the providers and the integrity of the user's hardware. For the broader industry, this means that the move to passwordless authentication does not render traditional security layers obsolete. For enterprises in particular, endpoint detection and response (EDR) remains a critical requirement, as a compromised device can serve as a gateway to bypass passkey protections.

Future Outlook

As the industry continues to migrate toward FIDO2 standards, the focus is expected to shift toward hardening the recovery and synchronization processes. While the cryptographic foundation of passkeys remains secure, the implementation of the supporting infrastructure remains a primary target. Security professionals will need to monitor how sync providers evolve their protection of private keys and how authentication prompts can be better shielded from malware-driven manipulation.