Authentication on CuraSec

Researchers Demonstrate Three Passkey Attack Classes That Bypass Phishing-Resistance

Tue, 11 Aug 2026 11:54:43 +0000

Engineer — Plan: If you’re deploying or have deployed cloud-synced passkeys, evaluate migrating to hardware-bound (device-local) passkeys where possible; the research shows synced passkey material can be exfiltrated by malware and Windows-issued signed auth tokens can be replayed — audit your passkey configuration to prefer non-synced, phishing-resistant authenticators.
SOC/IR — Learn: These attacks require malware already present on the endpoint, making detection of credential-theft behaviors (auth token exfiltration, suspicious cloud-sync API calls) the relevant angle — no published IOCs or ATT&CK mappings yet, but worth revisiting passkey-related telemetry if new technique details emerge.
Leader — Learn: Passkey rollouts sold internally as phishing-proof may need a qualification: device-bound variants maintain that property but cloud-synced ones carry residual risk if endpoints are compromised — useful context for board decks or vendor questionnaire responses that reference passkey adoption.

Mon, 03 Aug 2026 13:48:19 +0000

Engineer — Learn: A PAM-level biometric hook for sudo is worth evaluating before someone on your team installs it on a managed Mac; understand what attack surface a local face-recognition bypass introduces before adopting or banning it.
SOC/IR — Skip
Leader — Skip

Mon, 03 Aug 2026 13:48:19 +0000

Engineer — Plan: Audit your WebAuthn/passkey relying party implementation to confirm the User Verified flag is enforced; if your app accepts assertions without UV=true, you’ve silently degraded MFA to single-factor auth.
SOC/IR — Learn: No exploitation in the wild reported and no IOCs available; useful for understanding how passkey bypass could appear in authentication logs if UV flag checks are absent.
Leader — Skip