Loading story…
Recent Windows 11 updates have introduced several authentication-related issues and changes affecting user sign-in experiences. Microsoft has acknowledged that updates released since August may cause the password sign-in icon to disappear from the lock screen, although the password field remains accessible by interacting with the invisible button. Additionally, users employing FIDO2 security keys may now be prompted to set up or enter a PIN during authentication, a change implemented to comply with WebAuthn specifications and ensure consistent user verification across registration and sign-in flows.
Microsoft has not yet provided a permanent fix for the missing password icon but is working on a resolution. For the FIDO2 PIN prompt, organizations can adjust their WebAuthn configuration to discourage PIN entry if desired. These issues highlight the impact of recent Windows 11 updates on authentication workflows, requiring both end users and administrators to adapt to new behaviors and potential workarounds while Microsoft addresses the underlying problems.
See real exploitation activity before you spend the cycle.
6 events from the most recent confirmed update back to the earliest known activity.
Microsoft updated its support guidance to warn that Windows 11 updates released since August may make the password login icon invisible on the lock screen for affected users. The company said it is working on a fix but has not provided a timeline, and advised that the hidden option can still be selected by hovering over the blank space.
Microsoft published a support document on Tuesday warning that recent Windows 11 updates may prompt users to set up or enter a PIN when authenticating with FIDO2 security keys. The company also noted that organizations can avoid the prompt by setting WebAuthn user verification to discouraged.
Microsoft completed the rollout of the FIDO2 security key PIN prompt change with the November KB5068861 security update for Windows 11. The update can require users to set a PIN even if one was not configured during initial registration.
In September, Microsoft resolved additional problems linked to the same August Windows updates, including DRM-protected video playback interruptions, app installation failures for non-admin users, severe lag in NDI streaming software, and failed WSUS security updates. Some of these fixes were delivered through emergency updates.
After the August 2025 KB5064081 non-security preview update and later updates, some Windows 11 24H2 and 25H2 systems with multiple sign-in methods enabled began showing a blank area instead of the password sign-in icon on the lock screen. The password option still works if users hover over the invisible button.
Microsoft began rolling out a change in Windows 11 24H2 and 25H2 with the KB5065789 preview update that can prompt users to create or enter a PIN when using FIDO2 security keys. The change aligns Windows behavior with WebAuthn user-verification requirements, especially when identity providers request verification as preferred.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Password managers have become essential tools for users managing a growing number of online accounts, but they are also increasingly targeted by cybercriminals. Attackers may attempt to compromise master passwords through brute-force attacks, exploit software vulnerabilities, or use phishing techniques such as malicious ads to trick users into revealing their credentials. Security experts highlight the importance of vigilance and adopting best practices to mitigate these risks, as unauthorized access to a password vault can lead to identity fraud or the sale of sensitive credentials on underground markets. In response to evolving authentication needs and security threats, Microsoft has introduced native support for third-party passkey managers in Windows 11, including 1Password and Bitwarden. This integration, enabled by a new passkey API, allows users to manage passkeys—secure authentication credentials based on FIDO2/WebAuthn standards—directly within Windows. Passkeys offer enhanced security by leveraging public-private key cryptography and are resistant to phishing attacks. The update also brings native integration of Microsoft Password Manager, providing users with more flexibility and security options for managing their digital identities.
Jul 12, 2026
Microsoft confirmed that recent Windows updates have introduced a critical issue causing Kerberos and NTLM authentication failures on systems with duplicate Security Identifiers (SIDs). The updates, released since August 29, 2025, enforce stricter checks on SIDs, resulting in failed authentication handshakes between devices sharing the same SID. This has led to widespread login issues, including failed remote desktop connections, 'access denied' errors, and unsuccessful login attempts even with valid credentials, particularly affecting Windows 11 24H2, Windows 11 25H2, and Windows Server 2025 systems. The root cause is linked to Windows installations that were cloned or duplicated without proper preparation using the Sysprep tool, which can result in duplicate SIDs across devices. Microsoft has acknowledged the problem and provided guidance, noting that affected users may see specific errors such as SEC_E_NO_CREDENTIALS and warnings about machine ID mismatches in the Event Viewer. The company is working to address the issue and has published support documentation to help organizations identify and remediate impacted systems.
Jun 29, 2026
Microsoft has introduced a new Windows API that allows third-party applications, such as 1Password, to manage passkeys directly within Windows 11. This integration enables users to create, sync, and manage passkeys using their preferred password manager, leveraging Windows Hello for authentication. The update aims to simplify the user experience by allowing password managers to take over credential management from Windows, making it easier for users to adopt passkeys for secure authentication across devices and services. The shift towards passkey authentication is part of a broader industry move to replace traditional passwords with more secure, phishing-resistant credentials. Passkeys utilize cryptographic methods and can be managed by platform, virtual, or roaming authenticators, with password managers increasingly supporting software-only (virtual) authenticators. This approach addresses longstanding security issues associated with passwords, such as susceptibility to phishing and poor user password hygiene, and is expected to become the standard for online authentication as more services adopt passkey support.
Jul 12, 2026