Topic starter
11/08/2026 3:14 pm
TL;DR: Attackers are abusing passkey enrollment, not the cryptography itself, by combining voice phishing, lookalike login pages, and intercepted MFA codes to register attacker-owned passkeys during the bootstrapping phase, according to Versasec and Okta Threat Intelligence. The real gap is lifecycle control over enrollment and recovery, where phishing-resistant authentication still depends on weaker identity proofing.
Editorial analysis by NHI Mgmt Group, based on content published by Versasec: “The Phishing-Resistant Paradox: How Attackers Weaponized Passkeys (And How to Stop Them)”.
Key questions
Q: What breaks when passkeys can still be enrolled through weak proofing steps?
A: The passkey no longer protects the account at the moment that matters most.
Q: Why do passkeys still get phished in vishing campaigns?
A: Because attackers are targeting the human and process layer around registration, not the FIDO2 cryptography itself.
Q: How should security teams govern passkey recovery and enrollment together?
A: Treat them as one lifecycle problem.
Practitioner guidance
- Harden passkey enrollment workflows Remove open self-service setup where registration can be completed with low-assurance proofing or generic MFA fallback.
- Restrict credential issuance authority Require policy-controlled approval for creating new passkeys and separate enrollment from the same channel used for helpdesk support.
- Disable weak authentication methods for setup Use authentication strength rules to prevent SMS-based or push-based proofing from authorising new passkey creation.
Bottom line: Passkeys are resistant to traditional credential theft, but the enrollment workflow can still be abused if identity proofing is weak.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/08/2026 3:28 pm
Passkey bootstrapping is now the control plane that matters. The cryptographic strength of passkeys is not in dispute, but the security model collapses if enrollment is still validated with weak proofing. That means identity programmes must stop treating issuance as an administrative afterthought and start treating it as a governed trust decision. Practitioners should reframe passkey rollout around the step that creates the credential, not the factor that uses it.
A few things that frame the scale:
- The IBM/Ponemon 2025 Cost of a Data Breach Report found that phishing-initiated breaches cost an average of $4.8M each.
A question worth separating out:
Q: When does passkey adoption create new governance risk?
A: Risk increases when organisations treat passkeys as a pure authentication upgrade and ignore recovery, device loss, and enrolment governance. If the fallback path is weaker than the primary path, attackers will target the exception process instead of the authenticator itself. Strong adoption depends on managing the full identity lifecycle, not just sign-in.
👉 Read our full editorial: Passkey bootstrapping becomes the new phishing attack surface