UPDATE — the fourth passkey attack thread this pipeline could not source last week is now documented, and it closed: Windows cached YubiKey assertions in cleartext where any authenticated user could read them, and the July updates broke the chain
UPDATE · originally covered Three independent disclosures in one week attacked passkeys from both ends — the cryptography on a compromised endpoint and the enrolment on the phone — and the enterprise path, borrowing a signed-in session's Windows Hello key to authenticate to Entra ID, carries no CVE and no fix (2026-08-09)
the prior weekly covered three independent attacks on passkeys — forged Chrome synced-passkey assertions, a vishing pretext built around urgent FIDO2 enrolment, and borrowing a signed-in session's Windows Hello key to authenticate to Entra ID — and dropped a fourth because the sentence naming it could not be traced to any source that ran in that window. The delta is that the fourth thread now has a citable account, and it does not read the way an unsourced fragment implied.
SpecterOps principal security researcher Michael Grafnetter presented the firm's Pass-the-Passkey research at Black Hat USA 2026 on 5 August. The mechanism is distinct from the Windows Hello work the prior entry already carried: rather than using a hardware-bound key from a live session, it starts from stored material. "SpecterOps says Windows stored past YubiKey signatures in cleartext where authenticated unprivileged users, including remote users, could read them," and "The firm says chaining those signatures with weaknesses in Microsoft Entra ID's passkey validation allowed privileged-user impersonation despite policies requiring phishing-resistant multifactor authentication" (The Hacker News, 2026-08-10). Two properties make that worth recording even now that it is fixed. The read required no elevation — an ordinary authenticated account, including one arriving over a remote session, was sufficient. And the replay succeeded against a policy that was doing exactly what it was configured to do, because the assertion it accepted was genuine; nothing about the cryptography failed.
The correction is the outcome, and it runs opposite to the direction an open-ended reading would suggest. Microsoft's Windows-side flaw is tracked as CVE-2026-34348 with a vendor CVSS of 6.5 and was fixed in the July 2026 updates — before the research was presented. SpecterOps told the outlet it has not retested the Entra side since June, but "the firm now considers the full Windows-to-Entra vulnerability chain broken because Microsoft's July 2026 Windows updates make the WebAuthn assertions written to event logs unusable for replay attacks," and Microsoft stated it has also applied mitigations for the reported issue involving passkey relay assertions. So the honest status is closed on the researcher's own assessment, not open.
Triage: where an estate has not yet deployed the July updates, the observable is reading rather than writing — access to Windows event-log records containing WebAuthn or FIDO2 assertion data by an account that is neither an administrator nor a monitoring agent, and particularly from a remote session. That is worth separating from the ordinary case carefully: log collection agents and administrators read these channels constantly and legitimately, so the account class and the session type are the discriminators, not the read itself. On the Entra side, the sign-in telemetry shape that would correspond to a successful replay is an authentication satisfying a passkey or FIDO2 requirement for a user from a device or session with no prior passkey-registration history for that user — a mismatch between the authentication method claimed and the registration record that should underlie it.
SpecterOps says Windows stored past YubiKey signatures in cleartext where authenticated unprivileged users, including remote users, could read them.
The firm says chaining those signatures with weaknesses in Microsoft Entra ID's passkey validation allowed privileged-user impersonation despite policies requiring phishing-resistant multifactor authentication
the firm now considers the full Windows-to-Entra vulnerability chain broken because Microsoft's July 2026 Windows updates make the WebAuthn assertions written to event logs unusable for replay attacks.
ATT&CK mapping
4 techniques mapped from the cited reporting · MITRE ATT&CK v19.2
Initial Access TA0001
T1078.004Valid Accounts: Cloud Accounts
Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.
Persistence TA0003
T1078.004Valid Accounts: Cloud Accounts
Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.
T1556.006Modify Authentication Process: Multi-Factor Authentication
Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts.
Privilege Escalation TA0004
T1078.004Valid Accounts: Cloud Accounts
Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.
Stealth TA0005
T1078.004Valid Accounts: Cloud Accounts
Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.
Defense Impairment TA0112
T1556.006Modify Authentication Process: Multi-Factor Authentication
Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts.
Credential Access TA0006
T1552.001Unsecured Credentials: Credentials In Files
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
T1556.006Modify Authentication Process: Multi-Factor Authentication
Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts.
Lateral Movement TA0008
T1550.001Use Alternate Authentication Material: Application Access Token
Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems. These tokens are typically stolen from users or services and used in lieu of login credentials.
Sources
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.