The Human Element: Social Engineering Targets Passkeys

Passkey Phishing: Exploiting Trust in a Phishing-Resistant World

Passkeys were introduced to address the persistent threat of phishing, offering a more secure, phishing-resistant authentication mechanism. However, recent reports from Microsoft and other security researchers highlight an evolving threat: social engineering campaigns that manipulate users into compromising their accounts, even when passkeys are in use. These attacks do not exploit flaws in the FIDO2 protocol itself but rather target the human element, leveraging trust and urgency to bypass robust technical controls.

The Evolving Attack Vector

Recent campaigns detail sophisticated approaches where attackers impersonate IT helpdesk staff via phone calls, SMS, or even Microsoft Teams messages. The goal is to convince employees that their passkeys or multi-factor authentication (MFA) settings require immediate updates to prevent service disruption. This urgency, combined with the perceived legitimacy of the "IT support," can lead employees to unknowingly grant attackers access to their cloud accounts [6, 8, 9].

Key characteristics of these attacks include:

• Impersonation: Attackers leverage highly convincing impersonations of internal IT support, often using information gleaned from public sources or previous breaches to make their narratives more credible.
• Urgency and Fear: Victims are pressured with warnings of account lockout or loss of access if they do not comply immediately with the "update" instructions.
• Relay Attacks and Device Code Phishing: Instead of trying to steal the passkey itself, attackers often steer victims to adversary-in-the-middle (AiTM) proxy sites or trick them into approving device codes belonging to the attacker. These methods result in legitimate session tokens being issued to the attackers [7].
• Pretexting for Authentication Method Changes: Once an account is compromised, attackers swiftly add their own authentication methods (e.g., secondary MFA devices, new passkeys) to maintain persistent access, even if the user later changes their password [9].

Beyond the Passkey Protocol

It is crucial to understand that these attacks are not a failure of passkey cryptography. Passkeys remain robustly phishing-resistant at the protocol level. The vulnerability lies in the implementation and, more significantly, in human interaction. Attackers exploit employees' unfamiliarity with passkey management processes and the natural inclination to trust seemingly legitimate IT requests.

Once an attacker gains initial access, the consequences can be severe. Microsoft reports indicate attackers conducting high-volume activity in Microsoft Graph, downloading sensitive data from SharePoint and OneDrive, and collecting emails via Exchange Online. This access can lead to data exfiltration, further compromise of internal systems, and significant business disruption [8, 10].

Enterprise Defenses and Mitigation Strategies

Protecting enterprise cloud accounts from these evolving social engineering attacks requires a multi-faceted approach:

• Enhanced Employee Training: Regular, targeted training is paramount. Employees must be educated on how to identify social engineering attempts, verify the legitimacy of IT requests, and understand the secure processes for managing their authentication methods. Emphasize that legitimate IT personnel will never ask for credentials over the phone or direct users to suspicious links for authentication updates.
• Strengthened Identity Provider Controls: Configure identity providers (like Keycloak, Entra ID) to enforce origin-bound authenticators where possible, ensuring that relayed logins are unusable. Audit and restrict the use of device authorization grants to only clients that genuinely require them [7].
• Monitoring and Alerting for Authentication Changes: Implement robust monitoring for unusual sign-ins, changes to authentication methods, and the addition of new MFA factors. Anomalous activity should trigger immediate alerts and investigation.
• Conditional Access Policies: Leverage conditional access policies to restrict access based on device compliance, location, and other contextual factors. This can limit the damage of a compromised session.
• Secure Communication Channels for IT Support: Establish and communicate clear, secure channels for IT support interactions. Employees should know the official methods for contact and how to verify the identity of IT staff.
• Zero Trust Principles: Apply Zero Trust principles, continuously verifying identity and access, regardless of whether the user is inside or outside the traditional network perimeter.

While passkeys represent a significant leap forward in authentication security, their effectiveness is ultimately tied to the secure practices of both organizations and individual users. The latest wave of social engineering attacks serves as a critical reminder that cybersecurity defenses must always account for the human element, adapting to new ways attackers seek to exploit trust and leverage technological advancements for malicious gain.