The Social Engineering Paradox: Passkeys as a New Attack Vector

Passkeys: A Shield, or a New Lure for Social Engineering?

Passkeys have been lauded as a significant leap forward in authentication security, promising a phishing-resistant future by replacing vulnerable passwords with cryptographic credentials. However, recent observations from Microsoft Security Research and other industry experts reveal a concerning trend: attackers are leveraging the very concept of passkeys as a new social engineering vector, tricking users into compromising their enterprise cloud accounts. This paradox demands a re-evaluation of defense strategies, shifting focus from cryptographic strength alone to the critical human element and the broader authentication ecosystem.

The Evolving Threat: Impersonation and Fake Updates

Attackers are not breaking the underlying FIDO2 protocol or compromising the cryptographic strength of passkeys. Instead, they are exploiting user trust and unfamiliarity with new authentication methods. The modus operandi involves sophisticated social engineering tactics, often impersonating IT support staff to convince employees that they need to "update" or "set up" their passkeys or other authentication settings. This typically unfolds through:

• Impersonated Communications: Attackers initiate contact via phone calls, SMS, or even compromised internal communication channels like Microsoft Teams, posing as legitimate IT helpdesk personnel. They create a sense of urgency, warning users they might lose access if they don't comply immediately [6, 7].
• Deceptive Lures: The core of the attack is a pretext: the need to configure a passkey, multi-factor authentication (MFA), or single sign-on (SSO) setting. This often directs victims to phishing pages designed to mimic legitimate Microsoft sign-in portals [6, 8].
• Exploiting User Behavior: These attacks are particularly insidious because they prey on the user's intention to improve their security posture. When users believe they are setting up a secure passkey, they are more likely to follow instructions that lead to compromise.

Beyond Passkeys: Compromising the Authentication Flow

It is crucial to understand that these attacks are not necessarily stealing passkeys themselves. Instead, they are manipulating the authentication process to gain legitimate session tokens or add attacker-controlled authentication methods. Key techniques observed include:

• Adversary-in-the-Middle (AiTM) Proxies: In some scenarios, users are lured into authenticating through an attacker-controlled proxy. While the user authenticates with their legitimate credentials (including their passkey), the attacker intercepts the resulting session token, gaining unauthorized access [9].
• Device Code Phishing: Another method involves tricking users into approving a "device code" that belongs to the attacker. This grants the attacker a legitimate session token without directly compromising the user's primary authentication factor [9].
• Adding Persistent Authentication Methods: Once an attacker gains initial access, a common follow-up is to add their own authentication methods (e.g., a new MFA device, a new passkey under their control) to the compromised account. This establishes persistence, allowing them to bypass future legitimate MFA prompts and maintain access even if the user changes their password [7, 10].

These actions allow attackers to establish persistence and control over the compromised account, often without ever needing to "steal" the user's passkey credential itself.

The Impact: Enterprise Cloud Account Takeovers

The consequences of these social engineering attacks are severe for enterprises, primarily leading to cloud account takeovers and data exfiltration. Microsoft has tracked activity where compromised accounts are used to:

• Conduct Reconnaissance: Attackers explore the compromised environment, mapping out internal resources and identifying high-value targets.
• Access Sensitive Data: This includes searching Microsoft Graph, downloading files from SharePoint and OneDrive, and collecting emails via Exchange Online [6, 7, 8, 10].
• Lateral Movement: Compromised accounts can be used to pivot to other systems or launch further attacks within the organization.

The fact that these attacks often begin with a call or text to an employee’s personal phone, or direct them to external phishing sites, complicates detection and investigation. Traditional enterprise monitoring tools may have limited visibility into these initial contact points [6].

Defending Against the New Wave of Social Engineering

Addressing this evolving threat requires a multi-faceted approach that combines technical controls with enhanced user education and operational vigilance. Enterprise security teams should consider the following strategies:

Strengthen User Education and Awareness

• Continuous Training: Regularly educate employees about the latest social engineering tactics, specifically highlighting how attackers might use "passkey updates" or "MFA configurations" as lures. Emphasize that IT will rarely, if ever, initiate unsolicited requests for authentication changes outside of official, pre-communicated processes.
• Verify Requests: Train users to always verify any unexpected requests for authentication changes through official, known channels (e.g., an internal IT portal, a pre-published IT helpdesk number) rather than responding to the originating communication.
• Recognize Phishing Indicators: Reinforce common phishing indicators, such as unusual sender addresses, grammatical errors, or suspicious URLs, even when the content appears to be from a trusted source.

Implement Robust Technical Controls

• Origin-Bound Authenticators: For identity providers like Keycloak, ensure authenticators are origin-bound. This makes relayed logins (via AiTM proxies) ineffective, as the session token would only be valid for the legitimate origin [9].
• Restrict Device Authorization Grants: Review and restrict device authorization grants to only those clients and users that genuinely require them. Default settings should prioritize security by keeping these off unless explicitly needed [9].
• Conditional Access Policies: Implement stringent conditional access policies based on device compliance, location, and risk signals. These policies can block or challenge access attempts from unusual or untrusted environments.
• Enhanced Monitoring and Alerting: Monitor for suspicious activity indicative of account compromise or social engineering attempts. Key indicators include:
  • Unusual sign-in patterns (e.g., from new locations, devices, or IPs).
  • Attempts to add new authentication methods to user accounts.
  • High-volume API activity, especially involving data exfiltration from services like SharePoint, OneDrive, and Exchange Online.
  • Changes to user configurations or security settings [8].
• Zero Trust Principles: Adopt a Zero Trust architecture, continuously verifying every access request regardless of its origin. Assume breach and enforce least privilege.

Foster a Culture of Security

• Reporting Mechanisms: Establish clear and easy-to-use channels for employees to report suspicious communications without fear of reprimand.
• Incident Response Planning: Have a well-defined incident response plan specifically for identity-related compromises, including steps for account isolation, forensic analysis, and rapid remediation.

The Path Forward

The introduction of passkeys represents a significant improvement in cryptographic security, but no technology is a silver bullet against human-centric attacks. The current wave of social engineering targeting passkeys underscores a fundamental truth in cybersecurity: the attack surface extends beyond technical vulnerabilities to encompass user behavior, trust, and operational processes. For enterprises, the imperative is clear: embrace the cryptographic strength of passkeys while simultaneously fortifying the human layer and the surrounding authentication ecosystem against increasingly sophisticated social engineering tactics. Proactive defense, continuous education, and vigilant monitoring will be key to protecting enterprise identities in this evolving threat landscape.