Notifications
Clear all
Topic starter
11/08/2026 3:14 pm
TL;DR: Attackers are abusing passkey enrollment, not the cryptography itself, by combining voice phishing, lookalike login pages, and intercepted MFA codes to register attacker-owned passkeys during the bootstrapping phase, according to Versasec and Okta Threat Intelligence. The real gap is lifecycle control over enrollment and recovery, where phishing-resistant authentication still depends on weaker identity proofing.
NHIMG editorial — based on content published by Versasec: The Phishing-Resistant Paradox: How Attackers Weaponized Passkeys (And How to Stop Them)
By the numbers:
- The attack has been executing a highly coordinated voice phishing campaign since April 2026.
Questions worth separating out
Q: What breaks when passkeys can still be enrolled through weak proofing steps?
A: The passkey no longer protects the account at the moment that matters most.
Q: Why do passwordless programmes still need strong lifecycle governance?
A: Passwordless shifts risk from passwords to issuance, recovery, and revocation.
Q: How do organisations know whether passkey adoption is actually reducing risk?
A: Track the share of accounts that are passkey-enrolled, the proportion of sign-ins still using passwords, and the number of recovery events that bypass the primary factor.
Practitioner guidance
- Map the passkey bootstrap path Identify every route that can authorize new passkey enrollment, including helpdesk resets, SMS fallback, push approvals, and self-service registration.
- Restrict enrollment to governed workflows Move passkey issuance into a centralized credential management process where policy controls device binding, proofing strength, and recovery authority.
- Disable weak fallback methods for passkey setup Remove SMS and similar weak proofing methods from the path to passkey creation.
What's in the full article
Versasec's full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step guidance on locking down passkey enrollment in Microsoft Entra ID, including disabling self-service setup.
- Specific Authentication Strengths configuration details for requiring FIDO2 security keys during authentication.
- Device restriction guidance for limiting registration to approved AAGUIDs and reducing unauthorised authenticator binding.
- The Credential Management System workflow that shifts enrollment out of user-driven trust paths and into policy-controlled administration.
👉 Read Versasec's analysis of passkey vishing and enrollment hijacking →
Passkey enrollment and vishing attacks: are your controls keeping up?
Explore further
11/08/2026 3:28 pm
Passkey security does not fail at the cryptographic layer, it fails at bootstrap. The cryptography behind passkeys remains sound, but the first proofing step is still often inherited from weaker IAM patterns. If a user can be socially engineered through a recovery or enrollment flow, the attacker never has to defeat the passkey itself. Practitioners should treat issuance as the control boundary, not the authenticator.
A few things that frame the scale:
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities, according to The State of Non-Human Identity Security.
- A separate finding shows that 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, which reinforces how weak governance surfaces often sit outside the primary login flow.
A question worth separating out:
Q: Who is accountable when a passkey is enrolled through social engineering?
A: Accountability sits with the identity programme, the helpdesk process owner, and the application team that allowed weak recovery or enrollment fallback. Passkey compromise through vishing is not just a user mistake. It reflects a governance decision to leave enrollment trust distributed across uncontrolled steps.
👉 Read our full editorial: Passkey bootstrapping becomes the new phishing attack surface
