Pass-the-Passkey attacks: what the new research means for passwordless security
Passkeys are quickly becoming the future of online login. They are easier to use than passwords, much harder to phish, and designed to protect users from the endless cycle of password leaks, credential stuffing, and fake login pages. Microsoft is also pushing the shift forward by making passkeys the default sign-in method for its cloud accounts starting September 1.
But a new security research presentation at Black Hat USA is a useful reminder: passkeys are a major upgrade, not a magic shield.
Security researcher Michael Grafnetter is presenting a family of attacks called Pass-the-Passkey, a name inspired by the older Pass-the-Hash technique. The research does not mean passkeys are broken. Instead, it shows that weak surrounding systems, poor implementation, and leftover password login options can still create dangerous security gaps.
In simple terms, passkeys are safer than passwords. But they must be set up correctly.
Cloud passkeys vs hardware security keys
Not all passkeys work the same way. There are two main types users should understand: cloud-synced passkeys and hardware security keys.
Cloud passkeys are the convenient option. They are stored in services such as Apple, Google, Microsoft, or a password manager and synced across your devices. That means you can sign in from your phone, laptop, or tablet without remembering a password. For most people, this is already a huge step forward because passkeys are resistant to phishing and do not rely on a password that can be stolen from a database leak.
However, cloud syncing adds another layer of risk. If an attacker compromises your cloud account, they may be able to target the passkeys stored there, depending on the service and device protections in place.
Hardware security keys are the stricter option. These are small USB, NFC, or USB-C devices that store the private key inside a secure chip. The private key cannot be exported remotely, which makes hardware keys especially valuable for high-risk accounts, administrators, journalists, executives, developers, and anyone who wants stronger protection.
The key difference is simple: a cloud passkey can be synced, while a hardware key is designed so the private key stays inside the device.
What the Pass-the-Passkey research found
Michael Grafnetter, a security researcher at SpecterOps, examined real-world passkey deployments and found that the cryptography behind passkeys remains strong. The problem is not the core passkey concept. The problem is how passkeys can be handled by operating systems, identity platforms, logs, and enterprise environments.
His research identified three weaknesses involving Windows 11 and Microsoft Entra ID that came close to being exploitable in serious ways. One issue involved Windows 11 writing a full copy of a key into an event log. Another involved Microsoft Entra ID not fully preventing reuse in certain circumstances.
Combined, these issues could have allowed attackers to take over privileged cloud accounts, even in environments using phishing-resistant multi-factor authentication.
The main flaw is tracked as CVE-2026-34348 and was fixed on July 14. Microsoft also corrected the cloud-side issue quietly.
For everyday users, the important context is this: the research mainly affects company environments using Microsoft Entra ID, Windows Hello, or FIDO2 security keys. It does not mean the passkey on your personal phone is suddenly unsafe.
The bigger lesson is that passkeys reduce risk dramatically, but organizations still need to manage logs, identity systems, recovery options, device security, and fallback login methods carefully.
Hardware keys are powerful, but choose wisely
A hardware security key is one of the strongest forms of account protection available, but not every key or login method offers the same level of defense.
The modern standard to look for is FIDO2 with WebAuthn. This is the phishing-resistant technology behind today’s strongest passkey and hardware key systems.
Older one-time-code methods, such as TOTP codes from authenticator apps, are still useful but do not offer the same phishing resistance. A fake login page can trick a user into entering a six-digit code. A properly implemented FIDO2/WebAuthn login is designed to prevent that.
Well-known hardware key brands such as YubiKey and Google Titan are widely used and mature, but popularity also makes them attractive research targets. Past research has shown that some older hardware keys could be cloned under highly controlled lab conditions. That does not mean users should panic, but it does mean security-conscious buyers should pay attention to certification, firmware history, and supported standards.
For the highest protection, a separate physical security key remains more conservative than relying only on a passkey built into a phone or laptop. A built-in secure chip may be very strong today, but a removable key gives you more control. If needed, you can disconnect it, store it securely, or keep a backup key in a safe location.
The most common passkey mistake: leaving the old password active
The biggest weakness in many passkey setups is not the passkey itself. It is the old password that remains active in the background.
Many users create a passkey and assume the account is now fully protected. But if the account still allows login with a weak or reused password, attackers will simply ignore the passkey and attack the password instead.
That old password becomes a back door.
To secure an account properly, follow this approach:
1. Set up a passkey or hardware security key for the account.
2. Save recovery codes in a safe place. Ideally, print them or store them in an offline password manager.
3. Turn off password login if the service allows it.
4. If password login cannot be disabled, replace the password with a long, unique, complex password and store it securely.
5. Review account recovery methods, including backup email addresses, phone numbers, and trusted devices.
6. Add a second hardware key as a backup for important accounts.
The goal is not only to add a passkey, but to remove weaker ways attackers can still get in.
Are passkeys still worth using?
Yes. Passkeys are absolutely worth using.
The new research does not change the main security message: passkeys are much safer than traditional passwords. They are resistant to phishing, they are not exposed in normal password database leaks, and they remove the need to remember or reuse passwords across websites.
What the research shows is that passkeys must be implemented carefully. A secure login method can still be weakened by poor logging, flawed identity systems, risky recovery options, or old passwords left enabled.
For most people, a cloud-synced passkey through Apple, Google, Microsoft, or a trusted password manager is the right next step. It offers strong security with everyday convenience.
For sensitive accounts, business administrators, financial platforms, developer accounts, or high-value cloud access, a hardware security key adds another layer of protection.
The future of login is clearly moving away from passwords. Passkeys are not perfect, but they make attackers’ jobs much harder. The smartest move is to adopt them now, understand their limits, and close the password back door wherever possible.
