Passkey bootstrapping becomes the new phishing attack surface

At a glance

What this is: This article shows how threat actors are turning passkey enrollment into an attack path by exploiting weak bootstrap and recovery workflows.

Why it matters: It matters because IAM teams can deploy phishing-resistant authentication and still leave account takeover paths open if enrollment, recovery, and lifecycle controls remain vulnerable to social engineering.

By the numbers:

• The attack has been executing a highly coordinated voice phishing campaign since April 2026.

👉 Read Versasec's analysis of passkey vishing and enrollment hijacking

Context

Passkey security is strong at the cryptographic layer, but identity programmes fail when enrollment and recovery still depend on weaker proofing steps. In practice, the first registration event often remains the easiest place for an attacker to intervene, especially when helpdesk trust, SMS fallback, or push-based verification are still accepted.

This passkey enrollment problem is an IAM governance issue as much as an authentication issue. If an attacker can hijack the initial bootstrap, they can create a durable credential relationship that looks phishing-resistant on paper but was established through social engineering and weak lifecycle control.

Key questions

Q: What breaks when passkeys can still be enrolled through weak proofing steps?

A: The passkey no longer protects the account at the moment that matters most. If an attacker can reach enrollment through SMS, push approval, or helpdesk social engineering, they can bind their own authenticator to the account and turn a phishing-resistant login method into persistent access. The control failure is bootstrap trust, not cryptography.

Q: Why do passwordless programmes still need strong lifecycle governance?

A: Passwordless shifts risk from passwords to issuance, recovery, and revocation. If those lifecycle steps are slow or unclear, users lose access, request exceptions, or reuse weaker paths to keep working. Strong lifecycle governance keeps the credential trusted throughout its usable life, not just at initial enrolment.

Q: How do organisations know whether passkey adoption is actually reducing risk?

A: Track the share of accounts that are passkey-enrolled, the proportion of sign-ins still using passwords, and the number of recovery events that bypass the primary factor. If password use remains high or recovery is frequent, the programme is still in transition rather than truly passwordless.

Q: Who is accountable when a passkey is enrolled through social engineering?

A: Accountability sits with the identity programme, the helpdesk process owner, and the application team that allowed weak recovery or enrollment fallback. Passkey compromise through vishing is not just a user mistake. It reflects a governance decision to leave enrollment trust distributed across uncontrolled steps.

Technical breakdown

Why passkey bootstrapping is still vulnerable

Passkeys use public key cryptography, which means the secret never leaves the device and cannot be reused like a password. The weakness appears before that state exists. Enrollment requires identity proofing, and many implementations still rely on legacy factors, self-service prompts, or helpdesk-mediated resets to establish trust. That creates a bootstrap window where an attacker can intercept the weaker step, complete registration, and bind their own authenticator to the account. The cryptography remains intact, but the issuance workflow becomes the control failure.

Practical implication: Treat enrollment as a privileged identity event and remove weak fallback proofing from the path to passkey creation.

How vishing defeats passkey rollout workflows

Voice phishing works here because the attacker does not need to break FIDO2. Instead, they manipulate the human and procedural layer around account setup. The victim is directed to a convincing lookalike subdomain, distracted with fake recovery content, and pushed through a real-time interaction that captures MFA codes or session steps before the legitimate user notices. The threat is not credential theft in the classic sense. It is enrollment hijacking, where an attacker uses a brief trust gap to mint a persistent authentication method for themselves.

Practical implication: Block helpdesk-led enrollment paths that can be completed in real time under attacker pressure.

Why centralized credential management changes the model

A Credential Management System shifts passkey issuance out of the ad hoc user flow and into policy-driven administration. That matters because lifecycle control becomes explicit: who can enroll, which devices are allowed, how recovery works, and when existing authenticators are revoked. The article’s point is not that passkeys are weak. It is that unmanaged enrollment preserves the same procedural weaknesses that attackers have always exploited, only now the result is a stronger credential bound to the wrong actor.

Practical implication: Use centrally governed enrollment and device restrictions to keep passkey issuance inside a controlled lifecycle.

Threat narrative

Attacker objective: The attacker wants durable access that survives the phishing session and supports data extortion.

1. Entry occurs through voice phishing, where attackers impersonate internal IT helpdesk staff and steer victims toward a lookalike subdomain.
2. Escalation happens when the attacker intercepts MFA codes and uses the live session to register an attacker-owned passkey on the victim’s account.
3. Impact is persistent account access that is hard to dislodge because the attacker now controls a phishing-resistant authenticator tied to the account.

Breaches seen in the wild

• Moltbook AI agent keys breach — Moltbook breach exposed 1.5M AI agent keys.
• AI LLM hijack breach — attackers used stolen AWS access keys to hijack Anthropic LLM models on Bedrock.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Passkey security does not fail at the cryptographic layer, it fails at bootstrap. The cryptography behind passkeys remains sound, but the first proofing step is still often inherited from weaker IAM patterns. If a user can be socially engineered through a recovery or enrollment flow, the attacker never has to defeat the passkey itself. Practitioners should treat issuance as the control boundary, not the authenticator.

Identity enrollment is now a high-value attack surface, not an administrative afterthought. The article shows that attackers are targeting the moment an identity becomes passkey-enabled because that is when policy gaps are still exploitable. This is a lifecycle governance problem, not just an MFA problem. Teams need to review enrollment authority, device binding, recovery paths, and support workflows as one control chain, because the chain is only as strong as its weakest step.

Phishing-resistant authentication requires phishing-resistant proofing. That is the core governance takeaway. If SMS, push approval, or helpdesk interaction can still authorize credential creation, the organisation has simply moved risk from login to enrollment. The implication is that passkey programmes must be judged by the trust model around issuance, not by whether the final authenticator is FIDO2-based.

Credential Management System governance is the missing bridge between passkey adoption and durable identity control. The article makes clear that unmanaged self-service enrollment preserves user-driven shortcuts that attackers can weaponize. Centralised administration, device restrictions, and explicit lifecycle policy are therefore governance controls, not convenience features. Practitioners should align passkey rollouts with the same oversight expected for other privileged identity events.

Passkey adoption without lifecycle discipline creates false assurance. Organisations can report progress on phishing resistance while still allowing attacker-owned authenticators to be minted through social engineering. That gap is especially dangerous because it is easy to miss in audits that focus on authentication strength alone. Security teams should measure enrollment integrity with the same seriousness they apply to access certification and privileged changes.

From our research:

• Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities, according to The State of Non-Human Identity Security.
• A separate finding shows that 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, which reinforces how weak governance surfaces often sit outside the primary login flow.
• For lifecycle control guidance, see Ultimate Guide to NHIs , Lifecycle Processes for Managing NHIs for the operational controls behind provisioning, rotation, and offboarding.

What this signals

Bootstrapping risk will increasingly sit alongside authentication risk in IAM programme reviews. Passkey rollouts are already moving from proof-of-concept to enterprise control, but the security conversation now has to include enrollment, support workflows, and recovery authority. Teams that focus only on the final authenticator will miss the procedural gaps attackers use to mint a credential in the first place.

Enrollment integrity is becoming a measurable control objective. Organisations should expect auditors and security leaders to ask not just whether passkeys are enabled, but how strongly new authenticators are issued and governed. That means mapping who can authorize enrollment, which fallback factors remain, and whether recovery can be abused through social engineering.

Ultimate Guide to NHIs , Lifecycle Processes for Managing NHIs provides the governance baseline for understanding why issuance, rotation, and revocation need policy, not convenience. The same lifecycle logic applies when the identity subject is a user authenticating with a passkey, because the risk sits in the trust chain that creates the credential.

For practitioners

• Map the passkey bootstrap path Identify every route that can authorize new passkey enrollment, including helpdesk resets, SMS fallback, push approvals, and self-service registration. Remove any step that can be completed under attacker conversation pressure.
• Restrict enrollment to governed workflows Move passkey issuance into a centralized credential management process where policy controls device binding, proofing strength, and recovery authority. Separate enrollment approval from the user session whenever possible.
• Disable weak fallback methods for passkey setup Remove SMS and similar weak proofing methods from the path to passkey creation. If a weaker factor is still required for initial enrollment, treat that dependency as a residual risk and track it explicitly.
• Constrain device and key registration Limit which devices and authenticators can be registered, and revoke any credentials created outside approved lifecycle controls. Device restrictions reduce the chance that a successfully phished enrollment becomes a long-lived foothold.

Key takeaways

• Passkeys reduce phishing exposure at login, but they do not protect an account if the enrollment path can still be socially engineered.
• The breach pattern is not cryptographic failure, but weak bootstrap governance that lets attackers bind a new authenticator to a real account.
• Security teams need passkey lifecycle controls, governed recovery, and enrollment restrictions before they can claim phishing resistance at scale.

Key terms

• Passkey Bootstrapping: The initial trust process used to create and bind a passkey to an account. In practice, this is where organisations often fall back to weaker proofing methods, which means the strongest authenticator can still be introduced through a weak trust path.
• Enrollment Hijacking: A social engineering attack that intercepts or manipulates the credential setup process so the attacker registers their own authenticator. The account remains legitimate, but the control relationship is transferred during creation rather than during login.
• Credential Management: Credential management is the lifecycle discipline for creating, storing, updating, monitoring, and retiring secrets used for authentication. In identity programmes, it covers both policy and process, including how credentials are protected at rest, moved between systems, and removed when no longer needed.
• Phishing-Resistant Authentication: Phishing-resistant authentication proves identity without relying on a user to approve a prompt or reveal a reusable secret. It typically binds access to a device, key, or cryptographic proof that an attacker cannot easily reuse or coerce. This approach reduces reliance on human judgment at login time.

What's in the full article

Versasec's full article covers the operational detail this post intentionally leaves for the source:

• Step-by-step guidance on locking down passkey enrollment in Microsoft Entra ID, including disabling self-service setup.
• Specific Authentication Strengths configuration details for requiring FIDO2 security keys during authentication.
• Device restriction guidance for limiting registration to approved AAGUIDs and reducing unauthorised authenticator binding.
• The Credential Management System workflow that shifts enrollment out of user-driven trust paths and into policy-controlled administration.

👉 Versasec's full article covers the Microsoft Entra ID controls, CMS workflow, and device restriction steps in more detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security programme, it is worth exploring.