Huntress: Passkeys Fail If Attackers Target Enrollment and Recovery Flows
Research reveals that while passkeys secure credentials, attackers bypass them by exploiting enrollment, recovery, and device code flows to gain access.
Key points
- Huntress researchers identified that attackers target enrollment and recovery processes rather than breaking passkey cryptography.
- The EvilTokens campaign used device code phishing to steal valid sessions from 344 organizations in 16 days.
- Compromised endpoints can manipulate WebAuthn interactions, requiring robust endpoint protection alongside passkeys.
Huntress published research indicating that passkeys do not eliminate account takeover risks. Attackers are shifting focus to enrollment, recovery, and alternative authentication flows to bypass the security benefits of phishing-resistant credentials.
The firm found that while passkeys protect stored credentials, they do not secure the entire account lifecycle. Threat actors exploit weaknesses in how users add authenticators, recover access, or interact with compromised endpoints, allowing unauthorized access without stealing the passkey itself.
Phishing and Device Code Exploits
Recent campaigns demonstrate how attackers use passkeys as social engineering bait. Huntress tracked the EvilTokens campaign, which affected 344 organizations across five countries in approximately 16 days. This operation used device code authentication, a flow typically used to activate streaming apps on smart TVs, to steal sessions.
Attackers initiated the device code process and sent convincing emails urging victims to enter a code on a legitimate Microsoft page. When victims complied, they authorized an attacker-controlled client, granting the threat actor a valid session. This method required no password theft, malware, or cryptographic breakage, only victim authorization of a legitimate flow.
Enrollment and Endpoint Vulnerabilities
Another tactic involves impersonating IT staff to convince employees to update their passkey configuration. Microsoft researchers found that in such incidents, the passkey served as a lure while attackers pursued other authentication methods, including non-phishing-resistant multi-factor authentication. These attacks highlight that defenders must identify the specific policy allowing access, not just assume the passkey was defeated.
Enrollment and recovery processes represent critical security boundaries. If an attacker can register a new credential or exploit a weak recovery process, they gain access while the original passkey remains secure. Organizations must enforce strong verification for any action that adds an authenticator or resets multi-factor authentication to close these gaps.
What should you do?
Defenders need to monitor for suspicious activity around legitimate sign-ins using identity threat detection and response tools. Endpoint protection remains essential because research by SpecterOps shows that local execution can manipulate Windows WebAuthn interactions, such as capturing authentication responses via browser hooks.
Background: Social engineering
Look for urgency, secrecy, and deviation from standard channels. Verify identity through a separate, known communication path before acting. Isolate suspicious interactions immediately to prevent lateral movement within your network environment.
Read the full guide: Social Engineering Warning Signs and How to Respond
What to do and how to stay safe: Huntress
- Review and strengthen verification requirements for account recovery and authenticator enrollment processes.
- Deploy identity threat detection tools to monitor for anomalous sign-in behavior and unauthorized session creation.
- Maintain robust endpoint protection to prevent local malware from manipulating authentication challenges or responses.
- Train employees to recognize phishing attempts that use passkey setup or updates as social engineering lures.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Do passkeys protect against all types of cyber attacks?
No, passkeys protect credentials but do not secure enrollment, recovery, or alternative authentication flows that attackers can exploit.
How did the EvilTokens campaign steal access without passwords?
It used device code phishing to trick victims into authorizing attacker-controlled clients on legitimate Microsoft pages.
Can a compromised endpoint bypass passkey security?
Yes, SpecterOps research shows that local execution can manipulate WebAuthn interactions to capture authentication responses.
