The Passkey Paradox: Social Engineering and the Human Element

The Evolving Threat of Social Engineering in a Passkey World

Passkeys represent a significant leap forward in authentication security, offering robust protection against traditional phishing attacks by eliminating phishable secrets. Yet, recent threat intelligence indicates a new wave of social engineering campaigns is emerging, specifically designed to exploit the human element within the passkey adoption process. For enterprise security architects and IAM engineers, understanding these nuanced attacks is critical to maintaining a strong security posture.

Passkeys: A Strong Defense, But Not a Panacea

Traditional authentication methods, particularly passwords, have long been the weakest link in enterprise security. Their susceptibility to phishing, credential stuffing, and brute-force attacks has driven the industry toward more resilient solutions like multi-factor authentication (MFA) and, more recently, passkeys. Based on the FIDO2 standard, passkeys are inherently phishing-resistant because the cryptographic keys are bound to the specific relying party (website or service) and cannot be phished to a malicious site. This makes them a powerful tool in the fight against account takeover.

However, the strength of passkeys lies in their cryptographic underpinnings, not in their immunity to human manipulation. Attackers are adapting, shifting their focus from stealing credentials to tricking users into actions that inadvertently grant unauthorized access or register attacker-controlled passkeys.

The New Phishing Frontier: Device Code and Passkey Enrollment Exploits

Recent campaigns highlight two prominent social engineering vectors leveraging the shift to passkeys and common authentication flows:

• Device Code Phishing: Attackers are exploiting legitimate OAuth 2.0 Device Authorization Grant flows (RFC 8628), often used for device registration or CLI authentication. In these attacks, threat actors initiate a device login and then social engineer users via phone calls, SMS, or even Microsoft Teams messages to visit a legitimate Microsoft sign-in page and enter a code provided by the attacker. The user, believing they are completing a legitimate IT request, unwittingly authorizes the attacker's access. Microsoft recently detailed the takedown of "EvilTokens," a phishing-as-a-service platform that successfully leveraged this technique to compromise over 12,000 inboxes without stealing a single password or bypassing MFA cryptographically [7]. The attack capitalizes on human trust and the perceived urgency created by impersonating IT support.

• Passkey Enrollment Vishing: With the widespread rollout of passkeys, particularly by major platforms like Microsoft Entra ID [5], attackers have a new pretext. Campaigns have been observed where attackers impersonate IT help desk staff, contacting employees to inform them that their passkey, MFA, or SSO configuration needs immediate updating to avoid service disruption. They then guide users through a seemingly legitimate enrollment process that, in reality, registers an attacker-controlled passkey on the victim's account. This method exploits the user's unfamiliarity with new authentication methods and the pressure to comply with IT directives [5], [6].

The Persistent Threat: iAuthFlow v2 and Rogue Passkeys

A particularly insidious evolution in this landscape is the emergence of toolkits like "iAuthFlow V2." This phishing-as-a-service platform not only steals credentials but also silently registers an attacker-controlled passkey on the victim's account during the phishing interaction [8]. The critical implication here is that traditional incident response measures, such as forcing a password reset or revoking active sessions, become insufficient. Because the attacker's passkey is a permanent WebAuthn credential, resetting the password leaves it untouched. The attacker can then simply log back in later using the "try another way" option and authenticate with the rogue passkey they planted weeks earlier.

This fundamentally shifts the post-compromise landscape, requiring enterprises to re-evaluate their credential lifecycle management and incident response playbooks. The ability for an attacker to maintain persistent access, even after a password reset, underscores the importance of robust passkey governance.

What This Means for Enterprise Security Teams

For enterprise security architects, CISOs, and IAM engineers, these developments necessitate a multi-pronged approach:

1. Enhanced User Education: Focus training not just on why passkeys are secure, but how they are securely registered and used. Emphasize that legitimate IT requests for passkey registration will follow specific, verifiable procedures and will rarely involve unsolicited calls or urgent demands for immediate action. Teach users to recognize device code prompts and to verify the legitimacy of any request to enter a code.
2. Robust Passkey Governance: Implement strong controls around passkey registration and management. This includes:
   • Auditing and Monitoring: Continuously monitor for suspicious passkey registrations or authentication attempts from unusual locations/devices.
   • Conditional Access Policies: Leverage conditional access to restrict passkey registration to trusted devices, networks, or managed endpoints.
   • Regular Review: Periodically review registered passkeys for employees, particularly high-value targets, to identify and revoke any unauthorized credentials.
3. Strengthening Incident Response: Update incident response procedures to explicitly address rogue passkeys. A compromised account now requires not just password resets and session revocation, but also a thorough audit and revocation of all registered passkeys associated with the account.
4. Leveraging Origin-Bound MFA: Where possible, enforce hardware security keys (FIDO2 authenticators) for critical accounts. As highlighted by analyses of attacks like "BigBear 2.0," origin-bound FIDO2 is currently the only MFA method that structurally prevents Adversary-in-the-Middle (AiTM) phishing, as it binds the authentication to the legitimate origin [9]. While passkeys offer strong phishing resistance, some implementations may still be vulnerable to social engineering if not carefully managed.

The shift to passkeys is a vital step toward a more secure authentication future. However, enterprises must recognize that sophisticated adversaries will always target the human element. By understanding these evolving social engineering tactics and implementing comprehensive controls and education, organizations can truly harness the power of passkeys while mitigating their inherent human-centric vulnerabilities.