Enterprise Passkeys: Shifting Attack Surface to Enrollment & Recovery

The Evolving Passkey Landscape and New Attack Vectors

Passkeys are rapidly becoming the default authentication method across major platforms, including Microsoft Entra ID. This shift is a significant leap forward in combating traditional phishing attacks, offering robust cryptographic resistance. However, recent threat intelligence reveals a critical paradox: while passkeys are inherently phishing-resistant, adversaries are adapting their tactics, increasingly targeting the human element and the operational processes surrounding passkey enrollment and recovery flows. For enterprise security architects, CISOs, and IAM engineers, understanding this evolving attack surface is paramount to maintaining a strong security posture.

The Shift from Credential Theft to Enrollment Exploitation

Historically, identity-related cybercrime has heavily relied on credential theft through phishing. Traditional phishing attacks aim to trick users into revealing passwords, which attackers then use to gain unauthorized access. Passkeys, by design, mitigate this by eliminating the need for shared secrets (passwords) and relying on cryptographic key pairs tied to specific devices. This makes direct phishing for the "password" ineffective.

However, threat actors are agile. Instead of attacking the cryptographic protocol, they are now focusing on the weakest link: the human element and the administrative processes that facilitate passkey setup and recovery. Reports indicate a surge in cybercrime profits linked to account takeovers, with police urging passkey adoption [4]. Yet, this push comes with a caveat. The initial setup and recovery of passkeys, often involving human interaction or less secure fallback mechanisms, have emerged as prime targets.

How Attackers Exploit Enrollment and Recovery

Attackers leverage social engineering techniques to exploit vulnerabilities in how users create or regain access to their passkeys. This can manifest in several ways:

• Vishing Attacks: Voice phishing (vishing) campaigns trick users into providing information or performing actions that enable passkey enrollment on an attacker-controlled device. This might involve impersonating IT support or a trusted service, guiding the user through a seemingly legitimate "setup" process that inadvertently registers the attacker's device as a trusted passkey. The articles on vishing exploiting passkey enrollment [19, 20] underscore this specific threat.
• Social Engineering during Setup: Attackers can manipulate users during the initial passkey enrollment phase. This could involve directing users to malicious sites that mimic legitimate services, prompting them to "register" a passkey that is then linked to the attacker's infrastructure. The user believes they are securing their account, but in reality, they are handing over control.
• Recovery Flow Compromise: Account recovery processes often rely on alternative authentication methods, such as email verification, SMS codes, or security questions. If these fallback methods are compromised or weakly configured, attackers can use them to initiate a passkey recovery, registering a new passkey on their own device and effectively locking out the legitimate user. This creates a critical attack surface [8].
• Endpoint Compromise: While passkeys are tied to devices, if an endpoint itself is compromised through malware, an attacker might be able to interact with the passkey process on that device, or even extract or clone the passkey material if the implementation is flawed. This blurs the line between traditional endpoint security and identity security.

Implications for Enterprise CIAM and PKI

For enterprises managing customer identities (CIAM) or internal workforce identities, these evolving threats necessitate a proactive and holistic security strategy:

• Rethink Enrollment and Recovery Workflows: Enterprises must rigorously audit and harden passkey enrollment and recovery processes. This involves multi-factor authentication (MFA) for recovery, robust fraud detection, and clear, user-friendly communication that educates users on legitimate procedures versus potential scams. Assume that any non-passkey-protected step in the identity lifecycle is a potential target.
• Strengthen Social Engineering Defenses: Technical controls alone are insufficient. Comprehensive security awareness training is crucial to educate users about the new vectors of social engineering targeting passkeys. Emphasize that legitimate IT or service providers will rarely ask users to "set up" or "verify" passkeys over the phone or via unexpected links.
• Integrate CIAM and Fraud Detection: Robust CIAM platforms should integrate advanced fraud detection capabilities that monitor for anomalous passkey registration or recovery attempts. Behavioral analytics and risk-based authentication can identify suspicious activities that deviate from typical user patterns.
• Secure the Endpoint: Since passkeys are device-bound, endpoint security remains foundational. A compromised device can expose passkeys, regardless of their cryptographic strength. Ensure strong endpoint protection, regular patching, and secure configuration management.
• Continuous Monitoring and Audit: Implement continuous monitoring of all identity-related events, especially those involving passkey registration, modification, or revocation. Detailed logging and auditing are essential for detecting and responding to potential attacks swiftly.

The Path Forward: Balancing Security and Usability

The move to passkeys offers substantial security benefits, particularly in mitigating widespread phishing. However, as with any security evolution, new attack surfaces emerge. Enterprise security teams must recognize that the focus is shifting from attacking the cryptographic core of authentication to exploiting the human and procedural elements surrounding it. By proactively securing passkey enrollment and recovery flows, bolstering social engineering defenses, and ensuring robust CIAM and endpoint security, organizations can truly harness the power of passkeys while minimizing emergent risks.

This new era of identity security demands a shift in mindset: passkeys are phishing-resistant, but the process of using and managing them is not inherently social engineering-proof. Enterprises must close the trust gap in these critical lifecycle stages to fully realize the promise of a passwordless future.