“We use passkeys, so phishing can't get us.” I wouldn't be so confident. Passkeys are a major improvement in…
samuel watua Soita — Full Stack Software Engineer
“We use passkeys, so phishing can't get us.”
I wouldn't be so confident.
Passkeys are a major improvement in authentication security.
But attackers are adapting around the technology rather than simply attacking the cryptography.
Microsoft has documented active campaigns where attackers used passkey- and SSO-themed social engineering, adversary-in-the-middle phishing infrastructure, and device-code authentication flows to compromise Microsoft 365 identities.
The attack chain is what matters.
A victim may encounter:
Impersonation → convincing authentication request → compromised identity → persistence → cloud reconnaissance → data collection
The authentication mechanism may be strong.
The human and surrounding workflow can still be attacked.
That's an important lesson for security architecture.
Don't evaluate authentication in isolation.
Evaluate the entire identity lifecycle:
→ Enrollment
→ Authentication
→ Recovery
→ Device registration
→ Session management
→ Privilege changes
→ Third-party applications
→ Token access
A secure login doesn't automatically create a secure identity.
Identity security is a system, not a button.
#Cybersecurity #Passkeys #IdentitySecurity #IAM #ZeroTrust #Microsoft365 #CloudSecurity #ThreatIntelligence #CyberDefense #InfoSec
0 reactions · 0 comments
Topics: #identitysecurity, #iam, #microsoft365, #cloudsecurity, #infosec, #threatintelligence, #zerotrust, #cyberdefense, #cybersecurity, #passkeys