Passkey Social Engineering: New Threats to Enterprise Identity

The Evolving Landscape of Passkey-Themed Social Engineering

Passkeys, built on the FIDO2 standard, promise a significant leap forward in authentication security by replacing passwords with cryptographic keys resistant to phishing. However, recent developments highlight a critical distinction: the underlying cryptographic strength of FIDO2 does not inherently secure against every form of attack. Enterprises are now contending with sophisticated social engineering campaigns that leverage the concept of passkeys to compromise identities and cloud environments, even when the FIDO2 cryptography itself remains uncompromised. This shift demands a re-evaluation of enterprise security strategies, moving beyond just cryptographic integrity to encompass the entire authentication ecosystem and the human element.

The Anatomy of Passkey-Themed Attacks

Microsoft Security Research recently detailed active cloud-based intrusions stemming from "passkey-themed social engineering" [6]. These attacks are not exploiting flaws in the FIDO2 protocol itself but rather manipulating users under the guise of passkey enrollment or setup. The primary tactics observed include:

• Impersonation and Urgency: Threat actors pose as IT support or security personnel, often via phone calls or SMS, creating a false sense of urgency around a "security requirement" or a "passkey setup."
• Adversary-in-the-Middle (AiTM) Phishing: Users are directed to deceptive phishing sites that mimic legitimate sign-in portals, particularly those for Microsoft services. These sites act as proxies, capturing credentials and session tokens in real-time as users attempt to "authenticate" or "set up" their passkey [9].
• Device Code Authorization Bypass: Attackers may trick users into authorizing a device code, effectively granting the attacker