New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing-Resistant MFA

Researchers discovered three attack methods bypassing passkey protections: exploiting Windows authentication material exposure, abusing cloud-synced passkeys via malware, and using phishing-resistant MFA workarounds. Passkeys are increasingly used for email account protection, making these attacks directly relevant to email security practitioners.

https://thehackernews.com/2026/08/new-passkey-attacks-can-recover-synced.html