No passwords, no one-time codes, no phishing. That’s the future promised from passkeys, and for once the marketing (mostly) lives up to the hype. Strong, sound cryptographic controls – A Crypto Nerd’s Dream Scenario.
However, the cryptography is only as strong as everything around it (a certain XKCD comic with a $5 wrench comes to mind), and there’s lots around it; the browser, the operating system, the cloud service checking the signature, even you, the person approving the prompt. If attackers can’t break the cryptography, they’ll just go around it. Phishing-resistant doesn’t mean compromise-proof.
Michael Grafnetter (the researcher behind Shadow Credentials and DSInternals) first presented at Black Hat USA 2026 some practical red team attacks on passkeys. That was just weeks after Microsoft announced passkeys would become the Entra ID default. With that rollout now reaching organisations, and Microsoft’s own SMS and voice codes retiring on 1 February 2027, his research has gone from conference talk to a practical problem. Grafnetter presented three zero-day vulnerabilities in Windows 11 and Microsoft Entra ID, plus more than 20 attack techniques. All target the surrounding components of passkeys. None break the strong, sound cryptography of passkeys.
Loose Logs Sink Accounts: Windows 11 was writing complete passkey assertions, from Windows Hello, YubiKeys and even phones, to an event log any authenticated user could read. Paired with missing replay protections in Entra ID, that was enough to impersonate privileged cloud accounts and bypass phishing-resistant MFA. Note: Microsoft patched the logging flaw (CVE-2026-34348) in July 2026.
Replaying MFA Fatigue attacks: Hardware (or device-bound) passkeys (like YubiKeys or TPMs) can't be extracted directly by malware. However, malware doesn't need to steal them, instead they can just trick Windows into signing in and flood the user with endless, legitimate-looking prompts. Using an unfixed Microsoft flaw, attackers can even inject these pop-ups right inside the browser window.
Not all keys are created equal: Synced passkeys (like on AppleID, Google Chrome etc) trade security for convenience. The private key can be synchronised with a cloud vault/password manager. If an attacker gains access to these vaults, they have free reign of your passkeys. Device bound keys (like YubiKeys) don’t have this issue. For privileged accounts, it is recommended to implement device-bound passkeys with enforced attestation, so only genuine, approved authenticators can be used.
Persistence in the shadows: The admin feature that allows IT to pre-register security keys to new starters can also be used to plant a backdoor. An attacker with enough privilege can enrol a rogue passkey on a high-value account, and it keeps working even after a password change.
None of these findings present a good reason to abandon passkeys. It’s the same security advice 17 years later: patch your endpoints, block unsanctioned apps and browser extensions, and treat every unexpected prompt with suspicion. As the $5 wrench in the classic 2009 XKCD Security comic reminds us still today: The maths was never the weak spot, everything around it is (yes, this includes you).
What we read this week
Australia to Mandate AI Breach Reporting and Create Regulator After OpenAI Agent Incident - The Australian Government has accepted all recommendations from a rapid review into an incident in which an OpenAI agent gained unauthorised access to a Medicare medical statistics portal. Prime Minister Anthony Albanese announced plans for mandatory reporting by AI companies of misaligned behaviour or cyber incidents, consideration of criminal law reforms for serious misconduct, and the establishment of a new AI regulator to oversee security controls throughout development and deployment. The incident, first disclosed publicly in September, involved non-sensitive data and was described by OpenAI as unintentional. Organisations developing or deploying AI systems should prepare for tighter reporting obligations and independent model evaluations.
N-able Takes N-central Offline After Disclosure of More Than 30 Zero-Day Flaws - N-able temporarily shut down its hosted N-central remote monitoring and management environments and advised on-premises customers to power down servers after a researcher published technical details and proof-of-concept code for 33 alleged zero-day vulnerabilities (dubbed Able2Shell). The flaws could enable remote code execution, credential theft, creation of administrator accounts and full server compromise. N-able stated it had no evidence of active exploitation at the time of the shutdown and was working on a hotfix. Managed service providers and organisations relying on N-central should monitor vendor guidance closely and keep affected systems offline until patches are confirmed.
France Attributes Supermarket Refrigeration Cyber Attacks to Iran’s Revolutionary Guards - French authorities have formally blamed an Iranian cyber unit linked to the Islamic Revolutionary Guard Corps (Shahid Kaveh / CyberAv3ngers) for October attacks that remotely raised temperatures in commercial freezers and chillers at approximately 700 retail sites. The sabotage caused significant food spoilage, tens of millions of euros in losses and at least 15 fires. France summoned Iran’s ambassador and is seeking EU sanctions. The incidents highlight growing risks to operational technology in the food supply chain. Organisations operating commercial refrigeration or similar OT systems should review internet-facing controllers, apply firmware updates and segment industrial networks.
Russia-Aligned Turla Deploys Cereal Toolset to Intercept Emails on Government Exchange Servers - ESET researchers have detailed a new modular .NET toolset, named Cereal, used by the Russia-aligned APT group Turla (also known as Snake). The malware turns compromised Microsoft Exchange servers into stealthy collection and command hubs, intercepting selected emails (including those involving NATO and EU addresses in one case) without external C2 infrastructure. Victims included governmental organisations in Kazakhstan and Romania. The design relies on in-memory execution and traffic that mimics legitimate Exchange protocols. Defenders should prioritise Exchange server hardening, monitor for anomalous transport-agent behaviour and review historical logs for related indicators.
Microsoft November 2026 Patch Tuesday Addresses Record Volume Including Actively Exploited Outlook Zero-Day - Microsoft’s November Patch Tuesday fixed more than 1,000 vulnerabilities, including CVE-2026-124194, an actively exploited Outlook spoofing flaw that can disclose NTLM authentication hashes when a user opens a specially crafted message file. The release also covered critical issues across Windows, Office, Exchange and other products. Organisations should prioritise the Outlook update and review systems for signs of prior exploitation, while applying the broader set of fixes in a risk-based order.