Passkeys Are Phishing-Resistant. Until Malware Skips the Browser

Summary (technology + product/security findings)

This video is a technical security discussion about passkeys (including Windows Hello for Business, FIDO2/“UB keys”, and syncable/exportable passkeys). Despite being marketed as phishing-resistant, the discussion argues that malware-driven behavior and/or implementation flaws can still let attackers impersonate users.

Key speaker research context

• Michael Graphneta (principal researcher) focuses on Active Directory and Entra ID research.
• He has created/used tools such as a PowerShell “DSInternals” module for extracting password hashes from Active Directory.
• He is also associated with attacks/techniques such as Shadow Credentials (seen in both pentesting and malicious activity).

---

How the research frames passkey “phishing resistance”

• Passkeys reduce traditional phishing, but the browser/security boundary still matters.
• If an attacker compromises the endpoint, they may bypass “phishing-resistant” assumptions by using:
  • native APIs, and/or
  • event data, rather than tricking the user through normal browser UX.

---

Main security findings / attack categories

1) Windows vulnerability chain: signature replay via Windows Event Logs (fix required)

During sign-in to Microsoft Entra using passkeys (Windows Hello for Business / FIDO security keys):

• A digital signature was:
  • sent to the relying party (Entra website), and
  • written into Windows event logs (described as “event blocks” / event logs).

What the flaw enables

• A replay window (up to ~10 minutes) where an attacker could:
  1. monitor the logs,
  2. reuse the captured signed message, and
  3. log in to Entra as the victim.

Threat impact

• Could allow impersonation of even high-privilege users (example mentioned: global admins).
• Especially relevant in enterprise scenarios such as:
  • remote desktop users, and
  • multi-user terminal servers (where one user/malware can observe events from others).
• Malware could be stealthy because reading event logs is typically not flagged as malicious.

Clarification from the speaker

• Private keys are not logged.
• What’s logged are short-term digital signatures derived from the passkey.

Mitigations

• Windows fix: stop logging the replayable full signature/contents.
• Entra mitigations: use passkey signature counters (anti-replay).
  • If counters repeat, block authentications.
  • Complication: some authenticators (e.g., some software authenticators like KeyPass) may send zeros, so Entra must avoid false positives by enabling these checks only where compatible.

Action guidance mentioned

• Update Windows regularly and reboot to pick up fixes.

---

2) “Flooding / replay” exploitation demo

The demo showed that on an unpatched Windows machine, an attacker could:

• read the relevant JSON/signature data from the event log,
• paste it into a purpose-built “special browser” tool, and
• quickly log in to Entra.

---

3) “Malware-based passkey phishing” without needing browser phishing (API/dialog injection)

Another demo described an end-to-end scenario where:

• Malware runs on the victim device (no admin required).
• It enumerates/uses Windows Hello for Business passkeys already available on the machine.
• It triggers/uses APIs similar to how browsers display the passkey dialog.
• It repeatedly causes the user to see the passkey authentication prompt (modal/overlay), making it hard to notice.
• The attacker collects the resulting digital signature payload (JSON) and replays it to log in from the attacker’s environment.

How it’s “phishing” (in spirit)

• The attacker still coerces/induces approval-like behavior,
• but not through a classic fake website—rather by abusing the real system/browser passkey flow from malware.

Defender takeaway

• Treat passkey prompts that appear spontaneously / repeatedly as suspicious.
• Don’t automatically click “approve” on a prompt you didn’t initiate.

---

4) Syncable/exportable passkeys increase risk (software-protected vs device-bound)

The discussion contrasts:

• Device-bound passkeys
  • hardware-backed,
  • private keys don’t export,
  • signatures are short-lived.
• Syncable passkeys
  • often protected by software,
  • higher risk if private keys can be obtained from synchronized storage.

Demo concept

• Export passkeys from a password manager (example: Bitwarden) into a file (JSON).
• Decrypt/export material using a password (example assumes keylogging).
• Select the passkey entry and sign in to a passkey-supporting site.

Emphasis

• If private keys can be exported/cloned (even encrypted at rest), storage/password compromise can enable repeated signing.

---

5) “Passkey detours” (browser hook/modify behavior to steal the signature)

Final attack category (no demo shown, but consequences highlighted):

• Malware hooks/modifies browser behavior during legitimate passkey authentication.
• Instead of the user being authenticated normally, the attacker:
  • steals the digital signature, and
  • injects it into their own session to authenticate.

Defender/EDR implication

• EDR vendors may need detection for a “signature theft / injection” pattern.

---

Practical security guidance (defender-oriented)

• The biggest risk factor is endpoint malware: once malware is running, passkeys are no longer purely “phishing-resistant.”

Recommended controls

• Use privileged access workstation / secure admin devices
  • locked down,
  • minimal install capability.
• Apply stricter conditional access on high-privilege actions, such as:
  • compliant device requirement,
  • EDR running requirement,
  • hardened permissions/security posture for global admin access.

User behavior guidance

• Investigate prompts that pop up randomly or repeatedly.
• Verify sign-in origin (was it initiated?).
• Read the prompt details instead of blindly accepting.

---

Notable tooling / publication

• The speaker states the exploit tooling is open source and published at Spectre Ops’ GitHub (referred to as “speci injector” / passkey injection tooling).
• Tooling includes a browser-based mechanism to inject/submit passkey assertions/signatures.

---

Main speakers / sources

• Michael Graphneta
  • principal security research, associated with Specter Ops
  • presented Black Hat research and demos.
• Mariel
  • host of “Entra Chat”
  • asks questions and frames the discussion.