Loading story…
Passwordless authentication methods are increasingly being adopted to address the security weaknesses of traditional passwords, which are often reused, forgotten, or stolen. Modern approaches such as passkeys and biometric authentication, including facial recognition and fingerprints, offer enhanced security and user convenience. Passkeys utilize public-key cryptography, where a private key remains securely on the user's device and a public key is shared with the service, making them resistant to phishing attacks. Biometric methods, like facial recognition, authenticate users based on unique physical characteristics, with the verification process occurring locally on the device.
Despite misconceptions, passwordless authentication does not compromise security; instead, it often incorporates multi-factor elements by requiring both device possession and a unique user attribute, such as a fingerprint or PIN. These methods ensure that sensitive authentication data, like biometrics or PINs, never leave the device, significantly reducing the risk of credential theft. As organizations and users transition away from passwords, understanding the distinctions and strengths of passkeys and biometric authentication is essential for implementing secure and user-friendly access controls.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Enterprises are increasingly adopting passwordless authentication methods such as biometrics, passkeys, and security keys to enhance security and reduce the risks associated with traditional passwords. However, widespread implementation remains difficult, particularly for legacy systems, operational technology, and specialized applications that were never designed for anything other than passwords. Security leaders report that while most organizations can cover the majority of their threat landscape with passwordless solutions, the final 15%—often the most critical and legacy-dependent systems—remains resistant to change, creating operational and security challenges. Major technology providers like Google are actively promoting passwordless authentication, urging users to adopt passkeys and stronger authentication tools in response to increasingly sophisticated phishing and vishing attacks. Despite these efforts, the transition is hampered by technical, operational, and user experience hurdles, and attackers are exploiting gaps between multiple authentication systems. The push for a passwordless future is ongoing, but experts caution that full adoption may never be realized, and organizations must remain vigilant against evolving credential-based threats.
Jul 12, 2026
Security experts are increasingly recommending the use of long, random passphrases over traditional complex passwords, emphasizing that password length provides significantly greater resistance to brute-force attacks. Passphrases composed of several unrelated words are easier for users to remember, reduce the likelihood of password reuse or insecure storage, and align with updated guidance from organizations like NIST, which now prioritize length over forced complexity. Meanwhile, the adoption of passkeys—authentication methods based on public key cryptography—is gaining momentum as a more secure and user-friendly alternative to passwords. Passkeys eliminate the need for users to remember secrets and are resistant to phishing attacks, as authentication relies on cryptographic proof rather than shared secrets. While some skepticism remains due to marketing hype, the underlying technology offers substantial security benefits and represents a significant evolution in authentication practices.
Jun 29, 2026
Organizations are increasingly moving towards passwordless authentication methods, with technologies such as passkeys and device identity gaining traction as more secure alternatives to traditional passwords and multi-factor authentication (MFA). Passkey authenticators, often integrated into password managers or as standalone components, play a critical role in enabling seamless and secure login experiences by leveraging new standards and cryptographic techniques. Device identity further enhances security by binding credentials to hardware, making authentication resistant to phishing and social engineering attacks, while also improving user experience by reducing prompt fatigue and streamlining access to applications and networks. The identity security market is also witnessing strategic acquisitions, such as Ping Identity's purchase of Keyless, which aims to integrate privacy-preserving biometric authentication for frontline workers and address emerging threats like deepfakes. These moves reflect a broader industry trend towards comprehensive identity lifecycle management, resilience against AI-driven threats, and scalable support for both human and machine identities. As economic constraints limit large-scale mergers, the focus is shifting to targeted acquisitions that expand platform capabilities and reinforce the shift to passwordless, device-centric authentication models.
Jun 29, 2026