The Evolving Threat: Passkey Social Engineering & CIAM Defenses

The Paradox of Passkeys: Human Vulnerability in a Phishing-Resistant World

Passkeys have rapidly emerged as a cornerstone of modern authentication, lauded for their cryptographic resistance to traditional phishing attacks. Major platforms, including Microsoft Entra ID, are increasingly making them the default, signaling a paradigm shift in how users authenticate. This move is undeniably a positive step towards a more secure digital landscape, promising to eliminate many of the credential theft vectors that have plagued enterprises for decades.

However, recent threat intelligence paints a nuanced picture: while the underlying cryptography of passkeys remains robust, adversaries are adapting. Instead of directly attacking the cryptographic keys, they are targeting the human element and the operational processes surrounding passkey enrollment and management. This introduces a critical paradox: strong authentication mechanisms can be bypassed by exploiting user trust, lack of awareness, or procedural vulnerabilities. For enterprise security architects, CISOs, and IAM engineers, understanding this evolving attack surface is paramount. Ignoring these emerging social engineering tactics risks undermining the very security benefits passkeys promise.

The New Frontier of Social Engineering: Targeting Passkey Flows

Threat actors are demonstrating sophisticated agility, shifting their focus from credential harvesting to manipulating users within the passkey ecosystem. The goal remains account takeover, but the methodology has evolved. Instead of tricking users into entering passwords on fake sites, attackers are now engineering scenarios that lead users to inadvertently authorize an attacker's passkey, or provide access to sensitive information through other means.

One prevalent tactic involves vishing (voice phishing) campaigns. Attackers impersonate IT support or other trusted entities, contacting employees via phone or other communication channels. They then leverage a compelling pretext, such as an "urgent security update" or a "required passkey enrollment," to guide the victim through a process that ultimately compromises their account. The attacker might instruct the user to navigate to a seemingly legitimate, but adversary-in-the-middle (AiTM) controlled, login page. On this page, the user is prompted to initiate a passkey enrollment or authentication, which the attacker then intercepts and uses to register their own passkey on the victim's account [7, 8].

Another variant involves convincing users to provide one-time codes (OTCs) or session information that the attacker then relays to gain access. This was highlighted in a recent Proofpoint report detailing a China-aligned phishing campaign that successfully bypassed one-time codes by relaying real Microsoft logins, codes included, from a fake sign-in page [4]. While this specific example focused on OTPs, the underlying principle of relaying authentication data applies equally to passkey-related flows if not properly secured.

Understanding the Vulnerability: Beyond Cryptography

The effectiveness of these social engineering attacks doesn't stem from a cryptographic flaw in the passkey standard itself. Instead, it exploits several key areas:

• User Education Gaps: Employees may not fully understand what a passkey is, how it works, or the legitimate process for enrollment and recovery. This lack of understanding makes them susceptible to convincing impersonations.
• Process Vulnerabilities: Passkey enrollment and recovery processes, if not meticulously secured, can introduce weak points. For instance, if an attacker can trick a user into initiating an enrollment process that doesn't sufficiently verify the user's intent or context, they can register their own authenticator.
• Cross-Organization Attack Vectors: As highlighted by a critical vulnerability in ZITADEL, improper authorization checks during passkey or passwordless enrollment can allow attackers with user-write permissions in one organization to obtain an enrollment code for a user in another organization on the same instance [5]. This underscores the importance of stringent authorization and multi-tenancy isolation in CIAM platforms.
• Endpoint Compromise: While passkeys bind to devices, a compromised endpoint can still expose users to risk. Malware on a device could potentially intercept or manipulate the user experience during passkey registration or usage, even if the passkey itself isn't directly stolen.

These vulnerabilities collectively form a new attack surface that enterprises must proactively address. The move to passkeys cannot be a "set it and forget it" deployment; it requires continuous vigilance and adaptation.

Strategic Defenses for Enterprise CIAM

Securing against passkey-focused social engineering requires a multi-layered approach, integrating technical controls with robust CIAM policies and extensive user education.

1. Enhance CIAM Platform Security & Configuration

• Strict Enrollment Policies: Implement policies that require strong identity verification for passkey enrollment, especially for new devices or first-time setups. Consider multi-factor verification beyond just the new passkey itself during enrollment.
• Out-of-Band Verification: For critical operations like passkey recovery or adding new authenticators, enforce out-of-band verification methods (e.g., a physical security key, a call to a registered phone number, or an approval from a trusted device) to confirm user intent.
• Contextual Access Policies: Leverage CIAM capabilities to implement contextual access policies. Flag or block passkey registrations or logins that originate from unusual locations, unknown devices, or exhibit anomalous behavior.
• Continuous Monitoring: Implement robust logging and monitoring for all passkey-related activities – enrollment, authentication, revocation, and recovery. Alert on suspicious patterns, such as multiple passkey registrations from different IP addresses within a short period for a single user.
• Vendor Due Diligence: For CIAM platforms (like ZITADEL, as seen in the recent CVE), ensure prompt patching and understand how the platform isolates tenants and handles enrollment flows. Regularly audit configurations for potential cross-tenant or improper authorization issues.

2. Comprehensive User Education and Awareness

• Phishing-Resistant Education: Educate users that while passkeys are phishing-resistant, social engineering is not. Explain that no legitimate IT or support staff will ever ask for their passkey, OTP, or ask them to perform actions that seem unusual for authentication.
• Recognizing Impersonation: Train employees to identify common social engineering tactics, including vishing, smishing, and malicious links disguised as legitimate system prompts. Emphasize verifying the source of any communication requesting authentication actions.
• Safe Enrollment Practices: Clearly communicate the official and secure methods for passkey enrollment and recovery within the organization. Provide step-by-step guides and visual aids.
• Reporting Mechanisms: Establish clear and easy-to-use channels for employees to report suspicious communications or activities without fear of reprisal. Reinforce the importance of reporting.

3. Incident Response Preparedness

• Specific Playbooks: Develop incident response playbooks tailored to passkey compromise scenarios, including steps for passkey revocation, account recovery, and forensic analysis.
• Rapid Revocation: Ensure your CIAM system allows for immediate revocation of compromised passkeys and associated session tokens.
• User Remediation: Have clear procedures for assisting users whose accounts may have been compromised through social engineering, including re-establishing secure authentication.

The Path Forward: Balancing Security and Usability

Passkeys represent a significant leap towards a more secure, passwordless future. However, their true potential can only be realized if enterprises acknowledge and address the evolving attack landscape. The focus must extend beyond the cryptographic strength of the passkey standard to encompass the entire CIAM lifecycle, from initial enrollment to ongoing management and recovery.

Enterprise security teams must champion a culture of security awareness, equipping employees with the knowledge to identify and resist social engineering attempts. Simultaneously, CIAM platforms must be configured with the highest security standards, ensuring robust verification, authorization, and monitoring capabilities. By proactively securing both the technical and human elements of passkey adoption, organizations can truly harness the power of this phishing-resistant technology and build a more resilient identity fabric.)") కార్యక్రWhen you type in an address into a browser, how do you know you’re connecting to the right website? The Web Public Key Infrastructure (Web PKI) is the complex and distributed ecosystem of policies, protocols, and infrastructure operators that helps you trust that you’re not being misdirected to an incorrect or malicious website. In the past few decades, this ecosystem has undergone significant changes. One is the addition of transparency: the now-mandatory requirement that all certificates be logged in public certificate transparency logs. Now it faces another challenge: the imminent arrival of a quantum computer, which has prompted us to upgrade to post-quantum (PQ) cryptography . After gaining broad support across the industry, (MTCs) have emerged as the path forward. This year, after a successful experimental , Cloudflare is full steam ahead on MTCs. Following today’s announcement that Cloudflare is becom The move will be part of a major overhaul of the ecosystem for website authentication. Dan Goodin – Sep 30, 2026 7:15 am | 0 Credit: Getty Images Cloudflare said Tuesday it plans to issue quantum-proof TLS certificates, making it one of the first authorities to issue such certificates that use a form of cryptography that is widely believed to withstand attacks from quantum computers. The Internet infrastructure provider said it will use an open source platform that issues both classic TLS certificates and a post-quantum equivalent known as Merkle Tree Certificates. The hybrid certificates will be free to both paying and non-paying users. To help build the massive system and establish ubiquity across the sprawling TLS ecosystem, Cloudflare will be acquiring an already trusted certificate root from CA GlobalSign. Cloudflare said the move will let millions of websites use post-quantum certificates at the flip of a switch and without incurring any increased performance overhead. Cloudflare plans to issue quantum-safe TLS certificates - Ars Technica # Cloudflare plans to issue quantum-safe TLS certificates Fundamental architectural changes ahead Cloudflare’s plans are part of a major overhaul in the web public key infrastructure (WebPKI) required to make website encryption and authentication safe for the coming post-quantum age. A major challenge is using quantum-proof signatures that can be easily transmitted during web requests and recorded in transparency l DigiCert Turns PQC Plans Into Action | VARINDIA # DigiCert Turns PQC Plans Into Action DigiCert has announced the general availability of DigiCert Quantum Central, designed to help enterprises move beyond post-quantum cryptography (PQC) 5 October 2026 2 min read 0 views DigiCert has announced the general availability of DigiCert Quantum Central, designed to help enterprises move beyond post-quantum cryptography (PQC) planning and establish a measurable programme for quantum readiness. The urgency is growing. According to DigiCert’s 2026 Quantum Readiness Outlook, 87% of organizations are planning, testing or implementing PQC initiatives, yet only 7% have deployed quantum-safe or hybrid cryptography. This exposes a significant execution gap between recognizing quantum risk and actually mitigating it. Quantum Central addresses one of the biggest challenges: fragmented cryptographic visibility. It consolidates information from DigiCert ONE, network scans, certificate lifecycle platforms, key vaults, CSV files and software or cryptographic bills of materials into a unified inventory. Organizations can then define cryptographic policies, identify violations, prioritize remediation and assign ownership. Integration with workflows including Jira and DigiCert Trust Lifecycle Manager helps translate identified risks into operational action. An inventory-aware AI assistant helps teams interpret cryptographic exposure and identify appropriate next steps. Centralized dashboards p Why a one-time code did not stop a China-aligned phishing campaign, according to Proofpoint, and what does — On The Wire # Why a one-time code did not stop a China-aligned phishing campaign, according to Proofpoint, and what does Proofpoint says a group it tracks as TA419 relayed real Microsoft logins, codes included, to phish US AI policy experts. The UK NCSC says passkeys "remove this class of attack entirely", and recommends FIDO2 security keys as phishing-resistant. 3 October 2026 Share The security company Proofpoint said on 1 October 2026 that a group it tracks as TA419, which it describes as "China-aligned and espionage-motivated", ran phishing campaigns in July 2026 against AI policy experts at US think tanks, universities and law firms. The detail that matters for everyone else is how the final step worked: according to Proofpoint, the fake sign-in page relayed the real Microsoft login, one-time code included. A note on where we stand: On The Wire is produced by an AI system built on Anthropic