Loading story…
Passkey adoption has accelerated significantly, with e-commerce and business platforms leading the shift away from traditional passwords. According to Dashlane's 2025 Passkey Power 20 report, monthly passkey authentications have more than doubled in a year, reaching 1.3 million, and 40% of users now store at least one passkey. Amazon accounts for nearly 40% of all passkey authentications, followed by other major retailers like eBay, Lowe’s, Home Depot, and Target. Business platforms such as HubSpot and Okta have also seen rapid growth in passkey usage, with HubSpot reporting a 25% increase in login success rates and a fourfold reduction in login times compared to passwords or two-factor authentication.
Google stands out for its disproportionately high number of passkey authentications, driven by making passkeys the default login option for personal accounts and its role as a single sign-on provider for many other domains. Financial and cryptocurrency platforms, including Intuit, GitHub, Coinbase, Binance, and Kraken, are also among the top adopters. The operational benefits for organizations include reduced password resets, fewer help desk tickets, and lower risk of account compromise. While enthusiasm for passkeys is high, adoption rates vary by industry, with highly regulated sectors moving more cautiously due to higher assurance authentication requirements.
See the reporting duties and controls this puts on the clock.
5 events from the most recent confirmed update back to the earliest known activity.
Reporting published in late October 2025 said passkey use had doubled year over year, with Google and Amazon leading in authentication volume. The data reflected growing mainstream use of passwordless authentication.
The 2025 Dashlane Passkey Power 20 report found that passkey adoption was accelerating, with e-commerce and financial platforms leading usage. E-commerce companies such as Amazon, eBay, Lowe’s, Home Depot, and Target accounted for nearly half of all passkey authentications, while business platforms like HubSpot and Okta also showed strong growth.
Apple rolled out Credential Exchange to address portability limitations that had hindered passkey adoption across devices and ecosystems. The improvement helped reduce a key usability barrier for broader passwordless deployment.
Crypto platform Gemini required passkey adoption, leading to a dramatic increase in secure authentications. The move was cited as an example of how mandatory deployment can accelerate passwordless usage.
Major technology providers including Google, Apple, and Microsoft made passkeys the default login method for new accounts, driving substantial increases in passkey authentication rates. This marked a major shift from optional passwordless support to default adoption.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft has begun rolling out support for syncing passkeys across Windows devices and its Edge browser, addressing a key barrier to widespread adoption of passwordless authentication. This phased rollout starts with Edge on Windows 10 and 11, with plans to expand to iOS, Android, and MacOS, aiming to make passkey management seamless for users and organizations. The move is expected to accelerate the shift away from traditional passwords, leveraging the FIDO Alliance's non-phishable passkey standard to enhance security and usability across platforms. Industry experts highlight that passwordless authentication is not just a technological upgrade but a critical component in modern fraud prevention strategies. As organizations transition to passkeys and device-based authentication, they face challenges such as cross-device access and user education. Integrating behavioral analytics with passwordless systems is seen as essential for detecting sophisticated fraud attempts, including those involving AI-driven identity spoofing and deepfakes, ensuring both external and internal threats are mitigated effectively.
Jul 12, 2026
A new report from password manager 1Password highlights that weak or compromised passwords remain a significant security risk for organizations, with employee password practices worsening despite increased awareness. Survey data from over 5,000 workers across multiple countries reveals that a majority of employees, including IT professionals, continue to reuse passwords, rely on default credentials, or share passwords via insecure channels, exacerbating the threat landscape for businesses. The report underscores that even as companies move toward passwordless authentication, the transition is gradual and current credential management practices are not keeping pace with evolving threats. In response to these challenges, technology vendors are accelerating the adoption of passwordless solutions. Microsoft has released Edge version 142.0, introducing cross-platform passkey synchronization, allowing users to securely reuse passkeys across devices and browsers. This feature, which requires a dedicated PIN for access, aims to enhance both security and usability, reducing reliance on traditional passwords. The move reflects a broader industry trend toward passkeys and multi-factor authentication as default options, with major platforms like Google and Meta also embracing passwordless technologies to mitigate the risks associated with password-based authentication.
Jun 29, 2026
Passkeys are emerging as a modern alternative to traditional passwords, offering a more secure and user-friendly authentication method by leveraging cryptographic key pairs tied to user accounts. Unlike passwords, passkeys are resistant to phishing attacks and cannot be easily stolen or reused, as they are typically stored locally on a user's device and accessed through biometric or device-based authentication. Major organizations and technology providers, including those aligned with the FIDO Alliance, are promoting passkeys as a next-generation security solution. However, the implementation of passkeys introduces new considerations, particularly regarding how they are stored and synchronized across devices. There are two primary types of passkeys: device-bound, which remain on a single device or hardware security key, and synced passkeys, which are stored in consumer cloud services such as iCloud or Google Cloud and synchronized across multiple devices for convenience. While synced passkeys improve usability and account recovery for consumers, they introduce significant security risks for enterprises. If an attacker compromises a user's cloud account or abuses account recovery processes, they can authorize new devices and gain access to enterprise resources, undermining the integrity of the authentication system. Additionally, if employees use personal cloud accounts on corporate devices, passkeys may be inadvertently synced outside the organization's security perimeter, greatly expanding the attack surface. Attackers can also exploit help desk and account recovery workflows to copy protected keychains to unauthorized devices. Furthermore, adversary-in-the-middle (AiTM) attacks and malicious browser extensions can manipulate WebAuthn requests, force authentication fallbacks, and potentially leak credentials or one-time codes. Security experts and organizations such as the FIDO Alliance and Yubico recommend that enterprises mandate device-bound passkeys, preferably stored on hardware security keys, to maintain higher assurance and administrative control. Enterprises evaluating passkey deployments must carefully assess the risks associated with synced passkeys and implement policies that restrict their use in favor of more secure, device-bound alternatives. The adoption of passkeys should be accompanied by robust administrative controls, user education, and careful integration with existing identity and access management systems. Organizations must also review and strengthen their help desk and account recovery procedures to prevent attackers from exploiting these channels. As passkeys become more widely adopted, ongoing vigilance and adaptation of security practices will be essential to fully realize their benefits while minimizing new risks. The transition to passkey-based authentication represents a significant shift in enterprise security strategy, requiring both technical and operational adjustments. Ultimately, the effectiveness of passkeys in protecting enterprise assets depends on thoughtful implementation and a clear understanding of the associated risks and mitigations.
Jun 29, 2026