Loading story…
SpecterOps disclosed a "Pass-the-Passkey" attack family that can undermine passkey-based authentication in Windows 11 and Microsoft Entra ID without extracting private keys from hardware tokens or trusted enclaves. The most serious chain used Windows 11 event logging that recorded full WebAuthn assertion responses and paired it with Entra ID replay-validation weaknesses, allowing attackers to replay harvested assertions and gain access to privileged cloud accounts while still meeting phishing-resistant MFA checks. Microsoft addressed the Windows logging exposure as CVE-2026-34348, truncating logged signature fields to six bytes.
The research also described local attack paths that abuse legitimate WebAuthn APIs for prompt flooding, application identity spoofing, remote desktop pass-through, and Credential UI spoofing, enabling local passkey phishing and user-fatigue scenarios. Researchers released open-source tooling to help defenders test for assertion injection, event-log mining, and WebAuthn API hooking, and recommended patching Windows 11, enforcing server-side anti-replay protections, monitoring WebAuthn API activity, and requiring hardware-backed attestation for high-privilege Entra ID accounts.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Microsoft addressed the Windows 11 issue tracked as CVE-2026-34348 in its July 14, 2026 security release. The fix truncated logged WebAuthn signature fields to six bytes to prevent replay of harvested assertions from Event Logs.
A Security Friends research post documented a technique for evading Microsoft Entra ID Conditional Access policies via cross-tenant Resource Owner Password Credentials flows. The reference establishes public disclosure of the research on that date.
SpecterOps disclosed a family of more than 20 attack techniques exploiting weaknesses in WebAuthn implementations across Windows 11, Microsoft Entra ID, browsers, password managers, and enterprise authentication workflows. The research highlighted replay attacks enabled by Windows 11 logging full WebAuthn assertions and Entra ID failing to enforce key anti-replay checks, and it also released open-source defensive testing tools.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourceblog.fndsec.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security research has shown that attackers with low-privilege access to an active Windows user session can abuse **Windows Hello for Business** (WHFB) keys to authenticate to **Microsoft Entra ID** without the victim’s PIN, biometrics, or other presence checks. By invoking native Windows cryptographic interfaces from the compromised session, an attacker can use the victim’s hardware-backed key to sign authentication data, obtain **Primary Refresh Tokens** (`PRTs`), and generate **WebAuthn/FIDO2** assertions. Related research presented on attacking `PRTs` through their macOS implementation underscores broader interest in how platform-specific authentication flows can be leveraged to access cloud identity tokens. The Windows technique is described as a design-level weakness rather than a newly patched vulnerability, in part because WHFB supports scenarios such as Remote Desktop where direct user presence is not always enforced. The researcher also demonstrated that WHFB keys can function as passkeys to obtain tokens lacking a device ID claim, which can then be used to register a new device and establish persistence in the tenant. Defenders are advised to monitor Entra ID sign-ins that show Windows Hello for Business authentication without an associated device ID and to investigate suspicious new device registrations tied to affected accounts.
Aug 11, 2026
Adversary-in-the-middle (**AiTM**) phishing continues to undermine traditional MFA by proxying legitimate Microsoft sign-in flows in real time, allowing attackers to capture not only passwords but also **session tokens** and MFA responses. One investigation described how sophisticated redirect infrastructure (e.g., unusually deep redirect chains) can place the final phishing content beyond the reach of many email security scanners, and how **one-time URL tokens** can prevent defenders from reproducing the full chain after the fact—making *in-the-moment* evidence collection critical. The same analysis emphasized that **phishing-resistant MFA** (e.g., **FIDO2/passkeys**) is a more effective control because hardware-bound credentials cannot be relayed through a proxy. Operationally, defenders are being pushed to treat modern phishing as an infrastructure and workflow problem, not just a user-awareness issue: attackers increasingly use HTTPS, branded lookalike pages/domains, redirects, and short-lived links to evade detection, including **QR phishing** (codes embedded in PDFs that bypass URL scanning). Additional pressure tactics like **MFA fatigue** (push-spam) remain effective against push-based MFA, with mitigations including number matching, contextual prompts (e.g., location), and monitoring for abnormal push rates. For earlier detection of AiTM activity, one proposed tripwire is embedding **Canary Tokens** in Microsoft Entra ID tenant branding (e.g., custom CSS) to alert when an AiTM proxy loads the login page, while noting this is not universally reliable across all kits.
Jun 29, 2026
Researchers reported that Microsoft Entra ID’s legacy WS-Trust autologon endpoint for Seamless SSO can be abused to conduct password-spraying attacks with reduced defensive visibility. Testing found the `usernamemixed` endpoint remained reachable for older Office 2013-era clients, did not appear to trigger expected Smart Lockout protections, and omitted failed attempts from standard Entra ID sign-in logs. The endpoint also returned distinct `AADSTS` error codes that let attackers distinguish invalid passwords from valid credentials that were later blocked by MFA or Conditional Access, enabling efficient credential validation without full account access. The activity aligns with ATT&CK techniques for **Password Spraying** and abuse of **Valid Accounts**, including default or legacy authentication paths that permit legitimate-looking logons once credentials are known. Defenders were advised to disable the WS-Trust `usernamemixed` endpoint, block legacy authentication through Conditional Access, monitor the Unified Audit Log for autologon requests, and use detections for repeated failed logons from a single IP across multiple users—similar to Okta analytics that flag more than five invalid authentication attempts from one source as suspicious spraying behavior.
Aug 12, 2026