When the Credential Isn't the Weak Point: AiTM Token Theft Beats Both Passwords and Passkeys

Week of 28 September 2026 | Compiled by Team Paringa

Two stories this week make the same point from opposite directions: attackers have stopped trying to steal or guess credentials and started stealing the session that comes after — which works whether the authentication method was a password or a FIDO2 passkey.

What Happened This Week

🔴 Helpdesk vishing campaign harvests MFA approvals, then steals and replays the session token

Arctic Wolf disclosed a campaign — tracked as PREY-0058 and sharing "significant tradecraft similarities" with Google Mandiant's UNC6671 — that opens with vishing calls impersonating internal IT/helpdesk staff, directing targeted executives (specifically directors and VPs) to attacker-controlled login pages. Once the victim authenticates through the adversary-in-the-middle (AiTM) proxy, the operators harvest not just credentials but the live MFA approval and resulting session token, then replay that token from proxy infrastructure — reportedly including the NodeMaven residential-proxy service — geolocated to match the victim, defeating IP-based anomaly detection. From there, the group bulk-exfiltrates data from SharePoint, OneDrive, Exchange and Box before issuing extortion demands. Victims span construction and engineering, healthcare and pharmaceuticals, real estate, finance and professional services firms, primarily in the United States, disclosed 7 September 2026.

Arctic Wolf's own remediation advice is telling: it recommends phishing-resistant MFA and Conditional Access policies as mitigations — but the entire campaign is built around the fact that once any authentication method succeeds, the resulting session token becomes a bearer credential that can be lifted and reused independent of how strong the original factor was.

Sources: The Hacker News

This is the structural weakness every MFA-based (including "phishing-resistant" hardware-key) approach shares: authentication produces a credential — a session token or cookie — that persists after the login moment and can be stolen from the browser, replayed from anywhere, and used exactly like the real thing. The fix the industry keeps reaching for is tighter session binding and shorter token lifetimes, which are mitigations, not solutions, because a credential still exists to be stolen. Clients evaluating identity controls should ask vendors directly: after I authenticate, what is issued, where does it live, and can it be lifted and replayed elsewhere? If the answer involves a token sitting in a browser session, the AiTM risk hasn't gone away — it's just been made marginally harder.

🟡 Researchers show Entra ID's passkey/FIDO2 enforcement can be bypassed without breaking the cryptography

SpecterOps published research disclosing more than 20 distinct attack techniques against WebAuthn/passkey implementations — critically, none of them require breaking the underlying public-key cryptography. The core chain: Windows 11 was found to log complete, untruncated WebAuthn assertion responses (the cryptographic proof of authentication) directly to Event Logs, accessible to anyone with local or delegated endpoint access; those logged assertions could then be replayed against Entra ID because — per the researchers — "Microsoft Entra ID failed to verify challenge uniqueness, bind challenges to sessions, or track authenticator signature counters." The Windows logging flaw was tracked as CVE-2026-34348 and patched by Microsoft on 14 July 2026, but the underlying gap in Entra ID's server-side replay validation is the more consequential finding: an attacker who compromises an endpoint used by a privileged administrator can impersonate that admin's authenticated session without ever touching the private key stored in their hardware token or TPM.

Sources: CyberSecurityNews | Microsoft Security Response Center — CVE-2026-34348

The industry sold "phishing-resistant" as a synonym for "unstealable," and this research is the clearest evidence yet that the two are not the same thing. The private key genuinely can't be phished — but the assertion it produces at the moment of login is itself a bearer artifact, and if the platform logs it, fails to bind it to a session, or doesn't track replay counters, that artifact becomes exactly as stealable as a session cookie. Every one of the 20+ techniques SpecterOps found targets the surrounding plumbing, not the cryptography — which is the argument for architectures where no credential or credential-equivalent artifact is ever issued for an attacker to harvest in the first place, rather than architectures that issue a strong credential and then have to defend it perfectly forever.

🟡 Microsoft sets a hard deadline: passkeys become Entra ID's default, admins must act by 1 February 2027

Microsoft confirmed passkeys are becoming the default authentication method in Entra ID starting this September, with SMS and voice authentication being retired on Microsoft's own timeline. Admins who haven't explicitly configured their preferred authentication methods by 1 February 2027 will be migrated onto Microsoft's default passkey-first flow automatically. Forrester and multiple admin-focused outlets flagged this as a forcing function that will accelerate enterprise passkey rollouts industry-wide over the next several months, regardless of whether individual IT teams have finished testing device compatibility, break-glass account procedures, or legacy application support.

Sources: BleepingComputer | Microsoft Security Blog

This deadline is a useful conversation opener with any client on Entra ID: the migration is coming whether or not they've planned for it, and the SpecterOps research above shows that "we're moving to passkeys" and "we've eliminated the credential-theft attack surface" are two different claims. Clients should be pressed on whether their target architecture still issues something an attacker can capture and replay after the fact — because Microsoft's own roadmap doesn't answer that question, it just changes which credential type is at risk.

What CISOs Are Dealing With

Verizon's 2026 DBIR found vulnerability exploitation overtook credential abuse as the top breach vector (roughly 31% vs 13%), but credential abuse hasn't disappeared — it's evolved. The same report found only 23% of third-party organisations had fully remediated missing or improperly secured MFA on cloud accounts, and social engineering alone accounted for 16% of breaches. Read alongside this week's helpdesk-vishing and pass-the-passkey research, the picture is consistent: attackers have adapted to strong authentication by moving one step downstream, targeting the session and the assertion rather than the password. Every MFA method — SMS, push, FIDO2 hardware key, synced passkey — produces some artifact after the fact that a sufficiently determined AiTM operator can try to intercept.

This is also becoming a governance question, not just a technical one. NIS2's Article 21 risk-management obligations require "state of the art" authentication and access controls, and management-body liability provisions mean EU boards are now personally exposed to enforcement action if their organisation's authentication controls are found inadequate after an incident. As member states move through 2026 transposition and early audits, CISOs are increasingly having to document not just what authentication method they deployed, but what happens to the artifact it produces once the user is logged in — because regulators, insurers and now researchers are all asking that same question.

Three Things Worth Watching Next Week

1. Follow-on victim disclosures from PREY-0058/UNC6671 — Arctic Wolf and Mandiant tracking suggests more named victims are likely as the extortion phase of this campaign plays out.

2. Entra ID server-side hardening for WebAuthn replay — Watch for Microsoft to announce challenge-binding or signature-counter enforcement changes in response to the SpecterOps disclosure, beyond the single Windows-logging patch already shipped.

3. Early NIS2 enforcement signals — Any published enforcement action or fine tied explicitly to authentication/access-control failures would be the first concrete test of the Article 21 liability provisions as applied to identity.

Could not verify: Microsoft's own MSRC page for CVE-2026-34348 requires JavaScript and could not be fetched directly for independent confirmation of its CVSS score or exact wording; the CVE and patch date are corroborated only via secondary reporting (CyberSecurityNews) rather than the primary advisory text. Arctic Wolf did not disclose a total victim count or dollar-figure impact for the PREY-0058 campaign — treat any specific victim-count figure circulating elsewhere as unconfirmed.

Questions? hello@paringa.ai

Paringa's identity practice tracks exactly this gap — between what an authentication method promises and what artifact it leaves behind for an attacker to steal — because that gap is where this week's headlines keep originating. | 28 September 2026 | © Paringa Ltd