Passkey / WebAuthn attack-surface disclosure convergence (2026-08)

trend · trend:passkey-webauthn-attack-surface-2026-08

Cluster of independent research and criminal activity published in ISO week 2026-W32 attacking passkey and WebAuthn authenticators from multiple directions: Unit 42's Pass-ta-key work against Chrome/Google synced passkeys, Google Threat Intelligence Group's UNC6671 reporting on vishing whose pretext is a FIDO2 passkey enrolment, and Black Hat USA 2026 work by Dirk-jan Mollema on borrowing Windows Hello for Business keys to authenticate to Microsoft Entra ID (no CVE, not patched) and by Michael Grafnetter on a related class whose event-log element is CVE-2026-34348. The grouping is an analytical cluster surfaced by this pipeline, not an attribution claim by any cited source.

Aliases: Pass-ta-key, Pass-the-Passkey, Borrowing Windows Hello keys

Story timeline

Every entry that names Passkey / WebAuthn attack-surface disclosure convergence (2026-08), newest first. Rows tagged mention only name it in passing: they are listed for completeness and add nothing to the action items, pivots or ATT&CK profile on this page.

1. 2026-08-04Pass-ta-key: unprivileged malware forges Chrome synced-passkey assertions, registers its own user-verification key, and can steal the master secret that decrypts every passkey
   mentiondeep-diveUnit 42 shows three ways endpoint malware defeats Google synced passkeys without elevation, unlock or user interaction, and one of them cannot be revoked

Entries about Passkey / WebAuthn attack-surface disclosure convergence (2026-08)

No published entry is about this entity yet · the story timeline above lists the entries that mention it.

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

• Google Chrome×1
  productproduct:google-chrome
• Google Password Manager×1
  productproduct:google-password-manager