Passkeys Remain Secure While Attackers Exploit Enrollment and Device Code Flows

Passkeys provide strong authentication, but recent analysis indicates attackers are shifting focus to the surrounding account lifecycle. Huntress researchers published findings showing that while the passkey cryptography remains intact, threat actors target enrollment, recovery mechanisms, and alternative sign-in paths. This approach allows adversaries to gain access without directly compromising the passkey itself, leaving the original credential protected while they enter through other doors.

Root cause

The vulnerability lies not in the passkey standard, but in how organizations manage identity boundaries. Huntress notes that attackers look for any legitimate sign-in path that works in their favour. This includes weak recovery processes, unmonitored enrollment steps, and social engineering campaigns that impersonate IT staff. The root issue is a lack of comprehensive identity protection across the full account lifecycle, allowing attackers to exploit gaps outside the primary authentication mechanism.

Attack path

Attackers employ several methods to bypass passkeys. Huntress tracked the EvilTokens campaign, which used device code phishing to trick victims into authorising attacker-controlled clients. Victims entered codes on legitimate Microsoft pages, granting attackers valid sessions without stealing passwords. Other campaigns involved impersonating IT staff to urge passkey updates, steering users toward non-phishing-resistant multi-factor authentication flows. SpecterOps research also highlights endpoint attacks using browser hooks to capture or alter Windows WebAuthn responses, requiring local execution.

Affected versions

The source material does not specify software versions or CVE identifiers for these issues. The risks apply to environments using passkeys alongside other authentication methods, particularly where device code flows, legacy multi-factor authentication, or Windows WebAuthn interactions are present. Any organisation permitting alternative sign-in paths or lacking strict controls on credential enrollment and recovery is potentially exposed to these techniques.

Mitigation

• Implement strict verification and monitoring for all enrollment, recovery, and multi-factor authentication reset actions.
• Deploy identity threat detection and response tools to identify and contain suspicious activity around legitimate sign-ins.
• Maintain robust endpoint protection to prevent local execution and browser hook attacks that manipulate WebAuthn.
• Conduct security awareness training to help employees recognise passkey-themed phishing and social engineering attempts.

Signals worth monitoring

Security operations teams should review logs for unusual authentication patterns, particularly device code activations followed by immediate access to sensitive resources. Monitor for enrollment or recovery actions from unexpected locations or devices. Look for alerts indicating multiple failed authentication attempts followed by success, or changes to multi-factor authentication settings. Teams usually check whether session tokens are being issued to unknown clients. First containment moves often involve revoking active sessions, forcing password resets, and isolating compromised endpoints to prevent further lateral movement or credential theft.

What to do and how to stay safe: Passkeys

• Review identity policies to ensure strong verification for all credential enrollment and recovery processes.
• Monitor authentication logs for device code flows and other alternative sign-in methods that may be abused.
• Ensure endpoint protection is active and configured to detect browser hooks or local execution anomalies.
• Educate users on recognising passkey-themed phishing attempts that attempt to redirect them to other authentication flows.

General security guidance from the Firewall Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Are passkeys being broken by these attacks?

No, the source material states that passkey cryptography remains secure and untouched; attackers are exploiting other authentication flows and social engineering.

What is the EvilTokens campaign?

EvilTokens is a phishing-as-a-service kit that uses device code flows to trick victims into authorising attacker-controlled clients, stealing valid sessions.

How can endpoints undermine passkeys?

SpecterOps research shows that browser hooks on Windows can manipulate WebAuthn interactions, capturing responses or altering challenges if an attacker has local execution.