Loading story…
The UK government is rolling out optional passkey authentication across GOV.UK One Login, which serves more than 23 million people accessing public services. Following a trial with over 300,000 users, passkeys represent nearly 10% of daily sign-ins. Users can authenticate locally with a fingerprint, Face ID, device PIN, or pattern instead of a password and SMS-based two-factor code.
The FIDO2-based credentials are cryptographically bound to the legitimate service, making them resistant to conventional credential-phishing attacks. The government reports passkeys are up to eight times faster than the prior flow and have cut SMS verification costs by nearly £600 per day. Password-and-security-code login remains available, including for account recovery, leaving fallback controls important; users should avoid creating passkeys on shared devices because anyone who can unlock the device may be able to use the stored credential.
See the actors and campaigns active against you right now.
1 event from the most recent confirmed update back to the earliest known activity.
The UK government began expanding optional passkey authentication across GOV.UK One Login, covering more than 23 million users. The rollout followed a trial adopted by more than 300,000 people; password and security-code sign-in remains available, including as a fallback.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
4 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcecybersecuritynews.com
Open sourcetheregister.com
Open sourcegov.uk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft has begun rolling out support for syncing passkeys across Windows devices and its Edge browser, addressing a key barrier to widespread adoption of passwordless authentication. This phased rollout starts with Edge on Windows 10 and 11, with plans to expand to iOS, Android, and MacOS, aiming to make passkey management seamless for users and organizations. The move is expected to accelerate the shift away from traditional passwords, leveraging the FIDO Alliance's non-phishable passkey standard to enhance security and usability across platforms. Industry experts highlight that passwordless authentication is not just a technological upgrade but a critical component in modern fraud prevention strategies. As organizations transition to passkeys and device-based authentication, they face challenges such as cross-device access and user education. Integrating behavioral analytics with passwordless systems is seen as essential for detecting sophisticated fraud attempts, including those involving AI-driven identity spoofing and deepfakes, ensuring both external and internal threats are mitigated effectively.
Jul 12, 2026
Microsoft said it is phasing out SMS-based authentication and account recovery for personal Microsoft accounts, citing fraud, phishing, SIM-swapping, and delivery delays as key reasons for the change. Updated support guidance says users will be moved toward passwordless sign-in with **passkeys** and **verified secondary email addresses**, reflecting a broader industry retreat from SMS as a security control. The company has begun rolling out a redesigned sign-in experience that encourages users to choose a **"sign in faster"** option and create a passkey backed by device biometrics or a PIN. Microsoft said passkeys can be stored on devices, in password managers, or through Windows Hello-compatible hardware across Windows 11, Android, iOS, and macOS, but it has not given a final cutoff date for SMS, meaning users who still rely on texted codes will need to set up a passkey or verified backup email before the transition is completed.
Jun 29, 2026
Microsoft announced a major authentication overhaul for **Microsoft Entra ID** in the public cloud, making **passkeys** the default sign-in experience starting **September 1, 2026** and shifting customers away from phishable SMS and voice-based multifactor authentication. The company said users who still rely on SMS or voice MFA will be automatically prompted to register passkeys during MFA flows, and organizations will not be able to opt out of those registration prompts. Microsoft tied the move to rising phishing risk, including AI-assisted campaigns, and said passkeys provide stronger protection through public-key cryptography rather than shared secrets. Microsoft will also retire its native telecom delivery for SMS and voice authentication, with customers that still need those methods for regulatory or technical reasons required to use supported third-party telecom providers through the **Microsoft Security Store**. Administrator configuration for supported providers is scheduled to begin on **October 30, 2026**, with additional provider details and deployment guidance due earlier, while mandatory passkey registration for users dependent on SMS or voice is set to begin **February 1, 2027**. Reactions from administrators were mixed but largely unsurprised, with some citing prior SIM-cloning account compromises and others warning that the migration timeline is tight even as they accelerate user education on passkeys.
Sep 5, 2026