The Critical Attack Surface: Passkey Enrollment & Vishing Threats

Passkeys: Shifting the Attack Surface to Enrollment Flows

Passkeys have been hailed as the future of authentication, promising a truly phishing-resistant and user-friendly experience. Their design, rooted in strong cryptographic principles (FIDO2/WebAuthn), largely eliminates traditional password-based phishing. However, recent developments demonstrate that the security of passkeys is not solely determined by the robustness of their underlying cryptography but by the integrity of their implementation and, critically, their enrollment and recovery processes. Enterprise security teams must recognize that attackers are agile, and the shift to passkeys has merely moved the target, not eliminated it.

The Allure of Passkeys: A Double-Edged Sword

Passkeys leverage public-key cryptography to replace passwords, binding a user's identity to a cryptographic key pair stored securely on a device. This design inherently resists phishing, as the authenticator (e.g., a phone or hardware key) cryptographically signs an authentication challenge, proving its possession of the private key. This key cannot be phished or intercepted in the way a password can. For enterprises, this represents a significant leap towards reducing credential theft and strengthening account security.

Yet, this strength creates a new pressure point: the initial provisioning and ongoing management of these cryptographic keys. If an attacker can trick a user into registering their own passkey on the victim's account, or intercept the enrollment process, they effectively gain persistent access. This is precisely the vector being exploited in recent campaigns.

Vishing: The New Phishing for Passkeys

Vishing, or voice phishing, is emerging as a primary method for attackers to compromise passkey-secured accounts. This social engineering technique exploits the human element, rather than technical vulnerabilities in the FIDO2 protocol itself. Attackers use deceptive phone calls to persuade users to perform actions that inadvertently grant unauthorized access. With passkeys, these actions often involve manipulating the user during an enrollment or recovery flow.

Recent campaigns have demonstrated sophisticated tactics where attackers impersonate legitimate IT support or service providers. They often combine this with real-time phishing kits that mimic genuine login and passkey enrollment pages. For instance, the "Pink" group has been observed targeting Microsoft 365 users, using panel-controlled phishing kits to impersonate Entra ID login pages. During these vishing calls, victims are guided through a seemingly legitimate passkey enrollment process, but in reality, they are unknowingly registering an attacker-controlled passkey to their account [10, 9].

This method is particularly effective because:

• Circumvention of Phishing Resistance: Passkeys are phishing-resistant when used correctly. Vishing bypasses this by directly manipulating the user to initiate a legitimate (but malicious) enrollment.
• Exploitation of Trust: Attackers leverage the authority of IT or well-known brands to gain user compliance.
• Real-time Interaction: The live interaction of a phone call allows attackers to adapt their script, overcome objections, and guide users through complex steps.
• Enrollment Complexity: While passkeys are simpler for daily use, the initial setup or recovery can sometimes be more involved, creating opportunities for confusion and exploitation.

The ZITADEL Vulnerability Cluster: A Case Study in Implementation Flaws

Beyond social engineering, implementation flaws in identity platforms can also create critical vulnerabilities in passkey enrollment. A notable example is the cluster of vulnerabilities disclosed in ZITADEL, an open-source identity and access management platform [8]. One critical flaw, CVE-2026-105209 (CVSS 9.3), allowed for cross-organization account takeover via passkey enrollment. The core issue stemmed from an insufficient check during the issuance of passkey enrollment codes, where the system only validated the organization ID in the request header, ignoring the target user's actual organizational affiliation.

This meant that an attacker with minimal credentials could request an enrollment code for a user in a different organization, register their own passkey, and gain full control. While ZITADEL has since patched these vulnerabilities, this case serves as a stark reminder:

• Robustness of Underlying Protocols vs. Implementation: A strong protocol like FIDO2 does not guarantee a secure implementation.
• Complex Identity Contexts: Enterprise environments often involve intricate identity relationships (e.g., multiple organizations, federated identities). These complexities can introduce subtle but critical vulnerabilities if not handled with extreme rigor during development and deployment.
• Vendor Due Diligence: Enterprises must perform thorough due diligence on any identity solution, open-source or commercial, paying close attention to how passkey enrollment and management are implemented.

Protecting the Enterprise: Hardening Passkey Enrollment and CIAM

For enterprise security architects, CISOs, and IAM engineers, mitigating these evolving threats requires a multi-faceted approach that extends beyond simply deploying passkeys. It necessitates a focus on the entire Certificate Identity and Access Management (CIAM) lifecycle, with particular emphasis on enrollment, recovery, and user education.

1. Strengthen Enrollment and Recovery Flows:

• Multi-Factor Verification for Enrollment: Implement additional verification steps during passkey enrollment, especially for high-privilege accounts. This could involve an existing strong MFA method, a physical token, or out-of-band verification.
• Out-of-Band Enrollment Notifications: Send immediate and clear notifications to users (via email, SMS, or a dedicated security app) whenever a new passkey is registered to their account. Include instructions on how to report unauthorized activity.
• Strict Access Controls: Ensure that only authorized personnel can initiate or approve passkey enrollment for privileged accounts. Leverage role-based access control (RBAC) within your CIAM platform.
• Anomaly Detection: Implement systems to detect unusual passkey enrollment activity, such as enrollments from unfamiliar locations or devices, or a sudden spike in enrollment requests for a user.

2. Enhance User Education and Awareness:

• Vishing Training: Conduct regular security awareness training that specifically addresses vishing tactics and how they target passkey enrollment. Emphasize that IT will never call to walk them through a passkey setup over the phone.
• Reporting Mechanisms: Clearly communicate how employees should report suspicious calls or messages, even if they didn't fall victim.
• Verification Protocols: Train users to independently verify the identity of callers claiming to be from IT by calling back on a known, official number.

3. Rigorous CIAM Platform Auditing and Configuration:

• Regular Audits: Conduct frequent audits of your CIAM platform's configuration, especially related to passkey enrollment and account recovery. Verify that all security policies are correctly applied and enforced.
• Principle of Least Privilege: Ensure that the mechanisms for passkey enrollment and management adhere to the principle of least privilege, restricting administrative access to these critical functions.
• Logging and Monitoring: Implement comprehensive logging for all passkey-related events (enrollment, usage, deletion). Monitor these logs for suspicious patterns that could indicate an attack.
• Secure API Design: If your organization uses APIs for passkey integration, ensure they are designed with security-first principles, validating all inputs and enforcing strict authorization checks, as the ZITADEL case highlighted.

4. Vendor and Implementation Due Diligence:

• Security Assessments: Before deploying any CIAM solution or feature, perform thorough security assessments, including penetration testing focused on enrollment and recovery flows.
• Compliance with Standards: Verify that vendors adhere to industry best practices and security standards, especially regarding how they handle cryptographic keys and identity federation.

The Ongoing Evolution of Identity Security

Passkeys represent a significant stride towards a more secure digital future, but they are not a silver bullet. The evolving threat landscape demands continuous vigilance and adaptation from enterprise security teams. By shifting focus to the new attack surfaces created by passkey enrollment and recovery, implementing robust controls, and empowering users with education, organizations can truly harness the power of passkeys while effectively mitigating emerging risks. The journey to a passwordless future is an ongoing one, requiring not just technological adoption but a fundamental re-evaluation of identity security paradigms.