New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing-Resistant MFA

The investigation separated three technically different disclosures that had been grouped under a broad passkey headline. Microsoft and NIST verified the Windows Event Logging vulnerability and available security update, while primary research from Unit 42 and Mollema confirmed distinct post-compromise weaknesses around synced passkeys and Windows Hello for Business. Public demonstrations and code establish technical feasibility, but the reviewed evidence does not establish exploitation in the wild.

1. What event and claims did the supplied report combine?
   Read the supplied reporting and separated the SpecterOps, Unit 42 and Windows Hello for Business findings by prerequisite, component and impact.
   thehackernews.com ↗

   The report describes three distinct early-August disclosures and associates only SpecterOps' Windows logging element with CVE-2026-34348.

   why Separating the disclosures prevents the CVE, private-key recovery and Windows Hello key-use claims from being treated as one universal attack.

2. Does CVE-2026-34348 exist, and what does the vulnerability record establish?
   Reviewed the National Vulnerability Database record and its affected-platform and severity information.
   nvd.nist.gov ↗

   NIST records a Windows Event Logging Service protection-mechanism failure allowing an authorised attacker to disclose information over a network, with a Microsoft CVSS 3.1 base score of 6.5 and low privileges required.

   why This independently confirms the CVE and Windows scope, but does not itself substantiate every stage of SpecterOps' Entra replay chain.

3. What is Microsoft's status and remediation guidance for the CVE?
   Opened the Microsoft Security Response Center vulnerability advisory and checked disclosure, exploitability and affected-product information.
   msrc.microsoft.com ↗

   Microsoft released the advisory on 14 July 2026, rates the issue Important and publicly disclosed, assesses exploitation as less likely, and lists security updates for affected Windows 10, Windows 11 and Windows Server releases.

   why The vendor record confirms a patch path and does not support a claim of active exploitation.

4. What was initially reported about the Google Password Manager findings?
   Reviewed the focused reporting and followed its citation to Unit 42's primary publication.
   thehackernews.com ↗

   The report describes three attacks requiring malware on a TPM-equipped Windows endpoint and notes no reported exploitation, CVE identifiers or complete affected-version range.

   why This established the evidence gaps that needed checking against Unit 42's own research.

5. What did Unit 42 directly demonstrate and recommend?
   Read Unit 42's primary Pass-ta-key research, including its scope, disclosure notes and mitigation section.
   unit42.paloaltonetworks.com ↗

   Unit 42 demonstrated device-identity misuse, attacker-controlled verification-key registration and recovery of the Security Domain Secret from a compromised Windows endpoint. It recommends strict User Verified flag validation, registration attestation, hardened recovery, restricted local passkey data and protection of client-side key material.

   why The primary source confirms technical feasibility and endpoint prerequisites while providing no evidence of use against real victims.

6. What was claimed about Windows Hello for Business before checking the researcher's publication?
   Reviewed the focused report and identified the researcher's article and public ROADtools directory.
   thehackernews.com ↗

   The report states that a compromised signed-in session can invoke a Windows Hello for Business key without fresh user verification and that no active exploitation, victims or associated CVE were identified.

   why This framed the technique as post-compromise credential use rather than private-key extraction or an initial-access vulnerability.

7. Does the original Windows Hello research support the authentication and detection claims?
   Read Dirk-jan Mollema's technical article, with particular attention to prerequisites, cloud consequences and defensive telemetry.
   dirkjanm.io ↗

   Mollema reports that low-privilege code in a victim session can invoke the hardware-bound key, use it for Entra WebAuthn authentication, and potentially proceed to device registration and Primary Refresh Token access. He recommends detecting Windows Hello for Business sign-ins with an empty device identifier and monitoring unexpected device additions.

   why The primary account confirms the mechanism and provides a concrete detection hook, while noting legitimate sources of false positives.

8. Is SpecterOps' technical publication publicly accessible?
   Opened the SpecterOps Pass-the-Passkey white paper linked from the reporting.
   specterops.io ↗

   A public 73-page SpecterOps paper titled Pass-the-Passkey Family of Attacks is available for the work presented at Black Hat USA 2026.

   why The publication establishes public technical disclosure and supports treating the SpecterOps work as demonstrated research rather than an uncorroborated rumour.

9. Is reusable proof-of-concept code available for the Windows Hello technique?
   Opened the public ROADtools winhello_assertion directory and verified its contents.
   github.com ↗

   The directory contains fido_assertion.ps1 and hellopoc.ps1, with a recent commit adding the FIDO assertion script.

   why The repository confirms public proof-of-concept availability, but code publication does not demonstrate malicious exploitation in the wild.