Passkeys Are Strong, but Attackers Are Going Around Them

Passkeys are a major step forward in sign-in security, but protecting the credential is only part of protecting an account. Huntress notes that attackers can still target enrollment, account recovery, compromised devices, alternative sign-in options and the people using them. In passkey-themed phishing, the passkey is simply bait. Attackers pose as IT staff and urge employees to update or set up a passkey, steering them toward a sign-in flow the attacker can exploit.

Device code phishing shows how far this can go. Huntress researchers tracked a campaign called EvilTokens that hit 344 organisations across five countries in about 16 days. The attacker starts a legitimate device code sign-in, then sends a convincing email that leads the victim to enter the code on a real Microsoft page. The victim completes MFA correctly, and the attacker receives a valid session. No password is stolen, no malware is needed, and passkey cryptography is never attacked. EvilTokens was packaged as a phishing-as-a-service kit with AI-generated lures tailored to each victim's role, so the approach can scale.

In a separate campaign, attackers impersonated IT staff and told employees to update their passkey or sign-in settings. Microsoft researchers found the passkey was only the lure, while attackers pursued other authentication flows. One documented attack sequence involved MFA that was not phishing-resistant. Huntress stresses that this does not weaken the case for passkeys; it shows protection must cover the full account lifecycle.