Passkeys Were Supposed to End Credential Theft. Attackers Found the Gap Anyway.

Passkeys Were Supposed to End Credential Theft. Attackers Found the Gap Anyway.

Week of 27 July 2026 | Compiled by Team Paringa

Passwordless was meant to close the phishing gap. This week's news shows attackers adapting faster than the rollout — targeting the enrollment step and the session token instead of the credential itself.

SECTION 1 — What Happened This Week

🔴 Extortion Crew Hijacks Microsoft 365 via Fake Passkey Enrollment

Help Net Security reported on 9 July 2026 that the "Pink" cyber-extortion crew is compromising Microsoft 365 accounts by faking Entra passkey enrollment requests. The attack starts with a vishing call — the attacker poses as internal IT and tells the employee it's time to set up their new passkey. The victim, trained for months to trust passkey prompts as the secure, modern replacement for passwords, walks straight through the enrollment flow and hands the attacker persistent access. From there, Pink exfiltrates data from SharePoint and OneDrive, then uses the compromised account itself to send the extortion email and post internal Teams messages, lending the threat false internal credibility.

This is a serious signal for anyone treating passkey rollout as a security control that ends the conversation. The technology defeats classic credential phishing, but it introduced a new step — enrollment — that a well-briefed social engineer can hijack just as easily as a password reset call. Microsoft's own shift to passkey-by-default (system-preferred authentication expanded globally in May 2026) has, ironically, made "set up your passkey" a phrase employees now expect to hear from IT, which is exactly the cover Pink is exploiting.

Separately, SecurityWeek and Dark Reading both flagged fresh research this month showing WebAuthn process manipulation can bypass passkey login entirely in certain implementations — proof that "passwordless" is not synonymous with "unphishable" once the underlying protocol or the human enrollment step has a weak point.

Sources: Help Net Security, The Hacker News, SecurityWeek

The lesson isn't "passkeys don't work" — it's that any system built around issuing a credential, even a phishing-resistant one, creates a moment (enrollment, recovery, delegation) that a human can be tricked into approving. The only architectures immune to this class of attack are the ones where there's no credential to issue in the first place — nothing for IT to "help set up," nothing for an attacker to impersonate the process of installing.

🟡 Stolen Session Tokens Overtake Passwords as Attackers' Top Target

SpyCloud announced on 16 July 2026 that it has now surpassed one trillion recaptured identity assets from criminal marketplaces and malware logs — and for the first time, stolen session cookies and tokens make up nearly half of that total, overtaking stolen passwords. This confirms what Microsoft's own telemetry showed earlier this year: in April 2026, a single adversary-in-the-middle (AiTM) campaign compromised more than 35,000 users across 13,000 organisations in 26 countries in just three days, by proxying victims through the real Entra ID login page, letting them complete MFA normally, then stealing the session token issued afterward.

Obsidian Security's incident response data puts a hard number on how often this works: MFA failed to prevent account takeover in 84% of the incidents it investigated. The MFA wasn't broken — it did its job. The session token issued after MFA succeeded is what got stolen, and that token is functionally as good as a password for anyone who has it. Dedicated Phishing-as-a-Service platforms now rent this exact AiTM capability to any attacker with a subscription fee, which is why the technique scaled to 35,000 victims in 72 hours rather than staying a boutique nation-state tool.

Sources: Manila Times / GlobeNewswire, Diamatix

This is the real argument against "MFA plus session cookie" as an end-state architecture, no matter whose identity platform issues it. If authentication produces any artefact — password, session token, cookie — that artefact can be stolen and replayed by someone who was never the legitimate user. Enterprises need to ask their identity vendor a blunt question: after successful login, is there still something an attacker could steal that would let them back in without the user? If the answer is yes, the phishing-resistance claim only covers the front door.

🟡 NIS2 and NIST Push Enterprises Past Voluntary Passwordless Adoption

Regulatory pressure caught up with the technology this month. NIST's updated guidance now requires phishing-resistant authenticators for AAL2 rather than merely recommending them, and analysts tracking EU compliance report NIS2 enforcement is pushing organisations toward mandatory passwordless deployment after years of stalled voluntary adoption. Major SaaS vendors — Salesforce, GitHub, Okta, Cloudflare — now support passkeys as standard, and Microsoft's passkey-by-default rollout (March–May 2026) means most enterprise employees will meet a passkey prompt before year end whether their organisation planned for it or not.

The regulatory floor is rising just as the attack techniques above show why meeting the floor isn't the same as being safe. Compliance frameworks are catching up to "no password" — they haven't yet caught up to "no credential of any kind, including the one issued after login."

Sources: Cloudswitched, HID Global

Treat NIS2/NIST deadlines as the compliance minimum, not the security target. A board that hears "we're phishing-resistant, we deployed passkeys" this quarter needs a follow-up question: does that claim survive an AiTM session-token attack, or does it only survive a straight credential-phish? Most current passkey and FIDO2 deployments answer that question badly.

SECTION 2 — What Identity and Security Leaders Are Dealing With

The structural shift is that "passwordless" solved the wrong half of the problem. It killed credential phishing at the login screen but left two things standing: the human enrollment/recovery process, and the session artefact issued after authentication succeeds. Both are now actively targeted at scale — one through social engineering (fake passkey setup calls), one through technical interception (AiTM proxies harvesting tokens post-MFA). Identity leaders are discovering that "no password" and "nothing to steal" are not the same claim, and only the second one actually closes the attack surface criminal marketplaces are now built around.

Three Things Worth Watching Next Week

1. Further Pink-style enrollment social engineering — expect copycat campaigns targeting other identity providers' passkey/MFA setup flows, not just Microsoft's. 2. AiTM/session-theft volume metrics — SpyCloud's trillion-asset milestone will likely prompt follow-up data from Microsoft, Okta and others on token-theft scale; watch for updated breach statistics. 3. Regulatory guidance detail — NIS2 enforcement specifics and any NIST AAL2 clarifications on what counts as genuinely phishing-resistant, versus merely passwordless.

Questions? hello@paringa.ai

Paringa's identity partners deliver authentication with no credential and no session artefact to steal in the first place — closing the gap that passkeys and token-based MFA still leave open. | 27 July 2026 | © Paringa Ltd