Three separate research teams presented findings at Black Hat USA 2026 (August 5) showing that passkeys — the industry’s leading replacement for passwords — can be defeated through flaws in how Windows, Microsoft Entra ID, and Google Password Manager implement them. None of the attacks crack the underlying cryptographic math. Instead they reuse already-generated signed material Windows stored in logs, manipulate the trust machinery Chrome uses for synced passkeys, or have malware inside a compromised user session generate fresh authentication from a hardware-bound Windows Hello key.
SpecterOps: CVE-2026-34348 — replayed YubiKey signatures via Windows Event Logging
SpecterOps researcher Michael Grafnetter found that Windows stored past YubiKey authentication signatures in cleartext inside the Windows Event Logging Service, where any authenticated user — including remote users without elevated privileges — could read them. By chaining those reusable signatures with weaknesses in Microsoft Entra ID’s passkey validation, the team showed that an attacker could impersonate a privileged account even when Conditional Access policies required phishing-resistant MFA. Microsoft issued a patch for CVE-2026-34348 (CVSS 6.5, Windows Event Logging Service information disclosure) and says it has also applied server-side mitigations in Entra for the relay-assertion path.
Unit 42: “Golden Pass-ta-key” — recovering synced passkey private keys from Chrome
Unit 42’s research targets Google Password Manager’s synced-passkey system in Chrome on Windows. All three attack paths start with malware already running on the victim’s PC at standard user privilege. The most damaging variant, “Golden Pass-ta-key,” extracts Chrome’s Security Domain Secret — a 32-byte master key that protects all synced passkeys. Unit 42 initially found it exposed in Chrome’s device logging; Google removed it from that logging output after the report. The researchers note it is still temporarily present in Chrome’s process memory during re-registration, and that Google’s current implementation provides no mechanism to rotate or revoke the key, making any compromise persistent.
Mollema: bypassing Windows Hello for Business without PIN or biometrics
Researcher Dirk-jan Mollema found that software running in an already-compromised user session can call Windows cryptographic interfaces to use the Windows Hello for Business backing key — normally protected by the device’s Trusted Platform Module — without triggering a new PIN or biometric check. He then used the key as a FIDO2 credential against Microsoft Entra ID. Mollema also found that Entra WebAuthn challenges are valid for five minutes and are not bound to session, user, or tenant, meaning a challenge generated on the attacker’s system can be signed on the victim’s machine and returned as a valid WebAuthn assertion — capable of satisfying Conditional Access policies that require phishing-resistant authentication.
How to check if you’re affected
Affected versions include Windows 10, Windows 11, and Windows Server systems that have not yet received the August 2026 security update addressing CVE-2026-34348 — install the applicable Microsoft patch now. Enterprises using Microsoft Entra ID with passkeys or Windows Hello for Business should also monitor for unusual authentication events: Entra sign-ins tied to Windows Hello for Business without a device identifier are a red flag for Mollema-style abuse. Organizations relying on Google Password Manager synced passkeys should treat browser memory and Chrome’s device-logging output as credential-sensitive territory and apply endpoint detection accordingly.
Sources
- The Hacker News — New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing-Resistant MFA
- SpecterOps — Pass-the-Passkey research (presented by Michael Grafnetter, Black Hat USA 2026)