Tag
3 articles covering Passkeys across campaign analysis, detection engineering, and defender tradecraft.
Field Analysis
Microsoft tracked Storm-3121 and Storm-3032 running passkey-themed helpdesk calls since May 2026. The passkey narrative is a pretext that routes victims into AiTM and device-code flows — and the detection lives in what happens after the token lands, not in the lure.
Read more:Microsoft Security BlogBleepingComputer
Field Analysis
Revised October 2026. Our April assessment held that passkey fallback and recovery workflows would become attacker targets. Six months of research confirmed it and added something we did not anticipate: attacks against synced passkey key material itself.
Field Analysis
Phishing-resistant authentication reduces token theft risk, but account recovery, device replacement, and exception handling can reintroduce phishable paths.
Read more:CISAMicrosoft Security Blog