Passkey bootstrapping becomes the new phishing attack surface

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Versasec's blog post: Attackers are turning passkey enrollment into a phishing surface by abusing bootstrapping, helpdesk impersonation and weak proofing steps.

Why it matters: IAM teams need to treat passkey enrollment as a governed lifecycle, because phishing resistance in authentication is undermined when registration and recovery remain exposed to social engineering.

Context

Passkeys reduce the value of stolen passwords, but they do not remove the need to prove identity before a new credential is issued. That enrollment step is where weak proofing, SMS fallback and helpdesk-driven exceptions can reintroduce phishing risk into an otherwise stronger authentication model.

The security gap is not in public key cryptography. It is in the bootstrapping process that authorises creation of the passkey in the first place. When identity proofing is weak or recovery paths are easy to social engineer, attackers can enroll their own passkey and turn a phishing-resistant standard into a persistent access path.

Key questions

Q: What breaks when passkeys can still be enrolled through weak proofing steps?

A: The passkey no longer protects the account at the moment that matters most. If an attacker can reach enrollment through SMS, push approval, or helpdesk social engineering, they can bind their own authenticator to the account and turn a phishing-resistant login method into persistent access. The control failure is bootstrap trust, not cryptography.

Q: Why do passkeys still get phished in vishing campaigns?

A: Because attackers are targeting the human and process layer around registration, not the FIDO2 cryptography itself. They use impersonation, lookalike pages and real-time code capture to complete the proofing step, then bind a new passkey to the victim account under attacker control.

Q: How should security teams govern passkey recovery and enrollment together?

A: Treat them as one lifecycle problem. Recovery paths, enrollment approval and device acceptance should all be governed by the same assurance policy, because attackers only need the weakest path that can still authorise a new credential or reset a trusted one.

Q: When does passkey adoption create new governance risk?

A: Risk increases when organisations treat passkeys as a pure authentication upgrade and ignore recovery, device loss, and enrolment governance. If the fallback path is weaker than the primary path, attackers will target the exception process instead of the authenticator itself. Strong adoption depends on managing the full identity lifecycle, not just sign-in.

Technical breakdown

Why passkey bootstrapping is the weak point

Passkeys use public key cryptography, which means the private key never leaves the authenticator and the server only stores a public key. That makes replay and credential theft far harder than with passwords. The problem arises before the passkey exists, during bootstrapping, when the system has to decide whether the enrolling user is genuine. If that decision relies on SMS codes, push approvals or a helpdesk conversation, the attacker does not need to break FIDO2. They only need to win the identity proofing step that precedes issuance.

Practical implication: Treat enrollment as a security control point, not an onboarding convenience.

How vishing turns enrollment into credential theft

The attack chain described by Versasec uses real-time social engineering to keep the victim engaged while the attacker completes the session. The attacker impersonates IT support, guides the user to a lookalike login page and captures credentials and MFA codes as they are entered. With that session, the attacker can reach the legitimate account and add a new passkey under attacker control. The passkey then becomes a durable authenticator that survives the original phishing interaction, which is why the attack is more dangerous than a one-time code theft.

Practical implication: Separate enrollment authority from whatever channel is used for user interaction.

Why centralized lifecycle control matters for passkeys

A Credential Management System changes the control plane by moving passkey issuance out of open self-service flows and into policy-driven administration. That matters because the risk is lifecycle, not just authentication. If one workflow can create, approve and retain a passkey without strong governance, the organisation has delegated trust to the weakest step in the chain. Enrollment policy, device restriction and recovery governance all need to be enforced as part of the credential lifecycle, not bolted on after deployment.

Practical implication: Govern passkey issuance and recovery as lifecycle events with explicit policy gates.

Threat narrative

Attacker objective: The attacker wants durable account access that survives the original phishing session and can be used for data extortion.

1. Entry occurs through voice phishing, with the attacker impersonating internal IT support and directing the victim to an employer-branded lookalike site.
2. Credential access is gained in real time when the phishing kit intercepts the victim's credentials and MFA codes during the session.
3. Persistence is established when the attacker logs into the legitimate Microsoft account and registers an attacker-owned passkey.
4. Impact follows when the attacker retains phishing-resistant access that can support data extortion and long-term account abuse.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• Mailchimp breach 2022: Attackers socially engineered Mailchimp staff, used a support tool to export 102 customer lists and exposed customer API keys for phishing.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Passkey bootstrapping is now the control plane that matters. The cryptographic strength of passkeys is not in dispute, but the security model collapses if enrollment is still validated with weak proofing. That means identity programmes must stop treating issuance as an administrative afterthought and start treating it as a governed trust decision. Practitioners should reframe passkey rollout around the step that creates the credential, not the factor that uses it.

Phishing resistance is only as strong as the recovery path behind it. The article shows that attackers did not break FIDO2, they exploited the gap between initial verification and credential registration. That is a governance failure, not a cryptographic one. The implication is that authentication resilience now depends on enrolment assurance, recovery governance and explicit controls over who can authorise credential creation.

Credential Management Systems are becoming identity governance infrastructure, not just tooling. Once passkeys move into enterprise operations, issuance, device restriction and lifecycle changes are no longer edge cases. They become the conditions that determine whether phishing resistance is real or merely local to the login step. For security leaders, the control question is no longer whether passkeys work, but whether their lifecycle is strong enough to survive human deception.

Passkey enrollment is creating a new identity attack surface. This is a distinct concept from password phishing because the attacker is targeting the process that mints the credential, not the credential itself. That changes how practitioners should think about assurance boundaries, because a secure authenticator can still be born from an insecure workflow. The practical conclusion is to govern enrollment like any other privileged access decision.

From our research library:

• The IBM/Ponemon 2025 Cost of a Data Breach Report found that phishing-initiated breaches cost an average of $4.8M each.

What this signals

Enrollment assurance now sits alongside authentication assurance. The passkey story shows that identity programmes cannot judge success by login strength alone. If the proofing and recovery steps remain social-engineering friendly, the organisation has only moved the attack surface upstream.

Lifecycle governance is the missing control in many passkey rollouts. Registration, device binding and recovery should be managed as governed credential events, not as convenience features. That is where the assurance model either holds or breaks.

Passkey programmes will increasingly be judged by whether they can eliminate weak fallback paths rather than whether they can replace passwords at the login prompt. Security leaders should expect attackers to keep targeting the first trust decision in the chain.

For practitioners

• Harden passkey enrollment workflows Remove open self-service setup where registration can be completed with low-assurance proofing or generic MFA fallback.
• Restrict credential issuance authority Require policy-controlled approval for creating new passkeys and separate enrollment from the same channel used for helpdesk support.
• Disable weak authentication methods for setup Use authentication strength rules to prevent SMS-based or push-based proofing from authorising new passkey creation.
• Limit approved device identifiers Allow only specific device AAGUIDs or approved authenticators for enrollment so attacker-controlled hardware cannot be registered quietly.

Key takeaways

• Passkeys are resistant to traditional credential theft, but the enrollment workflow can still be abused if identity proofing is weak.
• The attack described in the source combines vishing, lookalike pages and real-time code capture to register an attacker-owned credential.
• Strong passkey adoption requires governed issuance, recovery and device acceptance, not just a phishing-resistant factor at login.

Key terms

• Passkey Bootstrapping: The initial trust process used to create and bind a passkey to an account. In practice, this is where organisations often fall back to weaker proofing methods, which means the strongest authenticator can still be introduced through a weak trust path.
• Credential Management: Credential management is the lifecycle discipline for creating, storing, updating, monitoring, and retiring secrets used for authentication. In identity programmes, it covers both policy and process, including how credentials are protected at rest, moved between systems, and removed when no longer needed.
• Phishing-resistant Enrollment: An enrollment process that cannot be completed through basic social engineering, intercepted SMS codes or low-assurance approvals. The term matters because a phishing-resistant authenticator can still be created through a phishing-resistant gap if the issuing workflow is weak.
• Device binding: A control that links an authenticator or key pair to a specific endpoint so the same secret cannot be copied and reused elsewhere. It strengthens assurance, but the binding step itself becomes a high-value target if attackers can intercept the enrollment process.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.