Passkeys Were Supposed to End This

Week of 10 August 2026 | Compiled by Team Paringa

New research this week found working ways to steal the very credentials FIDO2 and passkeys were built to make un-stealable - reopening the question of whether "phishing-resistant" login still means what enterprises think it means.

SECTION 1 - What Happened This Week

🔴 "Pass-ta-key": malware learns to steal passkeys, not just passwords

Palo Alto Networks' Unit 42 disclosed a new attack class in early August 2026 targeting passwordless authentication directly. Dubbed "Pass-ta-key," the technique abuses onboarding, account-recovery and device-trust workflows on Google-synced passkeys - allowing malware already present on a compromised endpoint to extract the passkey's private key material, authenticate with no user interaction whatsoever, and bypass the user-verification step passkeys were specifically designed to enforce.

This matters because the entire pitch of passkeys and FIDO2 hardware keys has been "phishing-resistant by design" - cryptographically bound to the domain, unphishable by a fake login page. Unit 42's research doesn't break that binding; it goes around it, through the recovery and sync plumbing that makes passkeys convenient across devices. The credential itself is still sitting on the endpoint, in a form that can be extracted once a machine is compromised by other means. Convenience and portability, it turns out, cut both ways.

Sources: Unit 42 (Palo Alto Networks) - Pass the Passkey: A Novel Attack Surface in Passwordless Authentication | SecurityWeek - New Attack Methods Enable Malware to Hijack Passkey-Protected Accounts

This is the pattern every "unphishable" credential eventually hits: as long as a credential - password, passkey, hardware token, session cookie - exists somewhere to be issued, synced, recovered or copied, there's a plumbing path for someone to go and get it. The only architecture that closes this off completely is one where no credential is ever issued to steal in the first place - authentication that verifies identity directly, in the moment, with nothing sitting on disk or in a sync service to extract. Anything short of that is a race between attacker research and vendor patching, forever.

🟡 84% of MFA still fails when it matters

Obsidian Security's incident-response data shows MFA failed to prevent compromise in 84% of the cases it investigated in the past year - not because MFA wasn't deployed, but because adversary-in-the-middle (AiTM) proxy kits capture the post-authentication session token the moment it's issued, regardless of how strong the first-factor challenge was. Microsoft's own telemetry recorded a single AiTM campaign compromising more than 35,000 users across 13,000 organisations in 26 countries in just three days earlier this year, run through commodity phishing-as-a-service kits anyone can rent.

The mechanics are simple and brutally effective: the victim authenticates against a pixel-perfect proxy, completes MFA exactly as normal, and the moment the identity provider issues the session cookie, the proxy steals it. The login was genuine. The session that came out of it wasn't the user's to keep.

Sources: WorkOS - How Attackers Are Bypassing MFA Using AI in 2026 | Startup Defense - Adversary-in-the-Middle Phishing: How AiTM Bypasses MFA

An 84% MFA failure rate against a technique that's been public for three years should be setting off alarms in every CISO's budget review, not a footnote in an incident report. Adding a second factor on top of a credential doesn't remove the credential - and a stolen session token doesn't care whether the login that produced it used a password, a hardware key, or a fingerprint. The fix isn't a stronger factor. It's removing the thing that gets phished, proxied or session-hijacked at all.

SECTION 2 - What Identity and Access Teams Are Dealing With

Adoption data from the FIDO Alliance puts passkeys at roughly 5 billion in active use globally, with a 93% login success rate against 63% for passwords - a real usability win. But usability and phishing-resistance are two different problems, and this week's research shows the industry has solved the first without fully solving the second. Every credential-based model, however cryptographically elegant, still has a credential sitting somewhere - synced, recovered, or held in a session - and that's the surface attackers keep finding new ways into. IAM teams are starting to ask a sharper question than "is this phishing-resistant": is there a credential here at all, or is the person being verified directly, every time, with nothing left behind to steal.

Three Things Worth Watching Next Week

1. Vendor response to Pass-ta-key - watch whether Google tightens passkey recovery/sync flows, and how fast other passkey providers audit their own onboarding paths for the same gap.

2. AiTM kits targeting FIDO2 rollouts - as more enterprises move to hardware keys, expect phishing-as-a-service operators to start marketing "FIDO2-aware" session-hijack kits specifically.

3. Session-binding as the next battleground - expect more vendors to push token-binding and continuous verification as a stopgap, rather than removing the credential that makes session theft valuable in the first place.

Questions? hello@paringa.ai

Paringa's identity partners build authentication where no credential is ever issued - nothing to phish, sync, extract or steal, because there's nothing there. | 10 August 2026 | © Paringa Ltd