Passkeys are still a major improvement over passwords. They remove shared secrets from the login flow, make phishing harder, and reduce the value of credential reuse. But Unit 42’s new research is a useful reminder that “passwordless” does not mean “endpoint-compromise-proof.”

In Pass the Passkey: A Novel Attack Surface in Passwordless Authentication, Unit 42 analyzed attack paths against synced passkey ecosystems, focusing on Google Password Manager in Chrome on Windows systems with TPM-backed device identity. The research describes ways malware already running on a victim endpoint could abuse local passkey state, device trust, onboarding, and user-verification assumptions to support account takeover.

What Unit 42 reported

The core issue is not that public-key authentication is broken. The problem is the operational layer around it. Synced passkeys depend on browser state, device-bound keys, cloud authenticators, user-verification flags, recovery flows, and relying-party validation. If malware has a foothold on the endpoint, it may be able to collect useful passkey metadata, manipulate local state, or cause authentication flows to treat attacker-controlled actions as trusted device behavior.

Unit 42 breaks the research into three broad attack classes: using a compromised device to impersonate legitimate passkey authentication, abusing user-verification handling, and extracting synced passkey material in ways that could make passkeys reusable outside the original device context. The research also highlights a relying-party risk: if a service does not strictly validate the WebAuthn User Verified flag, a login that looks cryptographically valid may not actually prove that the user unlocked the device or approved the action.

Why this matters for SMBs and government contractors

Many small businesses and contractors are moving toward passkeys because they are rightly tired of password resets, MFA fatigue, phishing kits, and stolen session credentials. That move is still good security. But the defensive model has to be honest: passkeys reduce phishing risk; they do not erase malware risk.

For a contractor, the most important accounts are usually cloud identity, email, source code, accounting, proposal portals, remote management, and customer systems. If an attacker gets code execution on a user workstation, especially a privileged admin or developer workstation, passkey-protected accounts may still be exposed through endpoint-side abuse. The control has shifted from “protect the password” to “protect the device and validate the authentication signal.”

Defensive takeaways

  • Keep adopting passkeys, but prefer phishing-resistant hardware-backed options for high-risk roles. Synced passkeys are convenient, but admins, finance users, developers, and executives should be evaluated for hardware security keys or stricter device-bound policies where supported.
  • Treat endpoint health as part of authentication. A passkey login from an unhealthy or unmanaged device should not carry the same trust as a passkey login from a managed, patched, EDR-covered device.
  • Require and validate user verification. Application owners and SaaS vendors should enforce WebAuthn user verification where risk demands it and verify the UV flag instead of assuming the platform handled it correctly.
  • Monitor passkey onboarding and recovery events. Unexpected re-enrollment, repeated recovery prompts, device re-registration, or changes to passkey-related local state should be treated as suspicious identity activity.
  • Harden browsers and developer workstations. Browser profiles, local sync databases, token stores, and credential-manager state are now high-value security assets. Limit extension sprawl, enforce patching, and monitor suspicious access to browser data paths.
  • Keep conditional access layered. Passkeys should sit beside device compliance, geo-velocity checks, session risk, impossible-travel alerts, privilege boundaries, and rapid account revocation.

Bulwark Black assessment

This research does not argue against passkeys. It argues against magical thinking. Passwordless authentication raises the floor, but attackers will naturally move toward the seams: the browser, the endpoint, recovery flows, and relying-party implementation mistakes.

For SMBs and government contractors, the practical answer is not to pause passkey rollout. The answer is to deploy passkeys with endpoint controls, conditional access, privileged-user segmentation, and clear monitoring around enrollment and recovery. The next wave of credential attacks will look less like fake login pages and more like malware abusing trusted authentication plumbing from inside the device.

Original research: Unit 42 — Pass the Passkey: A Novel Attack Surface in Passwordless Authentication