Many people are giving a Pass to Passkeys.
For the last few years, the security industry has told businesses the same reassuring thing about passkeys. Unlike a password, a passkey can’t be phished. There’s no secret to trick someone into typing into a fake login page, because the whole point of the technology is that nothing secret ever leaves the device.
That confidence took a real hit this month. Microsoft disclosed that attackers are actively using passkey-themed social engineering to breach cloud environments, hijacking Microsoft cloud accounts through a technique that specifically targets the passkey setup process rather than trying to steal a passkey directly.
What actually happened
The attack doesn’t break the cryptography behind passkeys, that part remains sound. Instead, it targets the human moment around passkey enrollment and account recovery, the point where a user is asked to confirm a device, approve a new sign-in, or set up a passkey on a new machine. Attackers impersonate that exact workflow convincingly enough to get a legitimate user to approve something they shouldn’t, at which point the attacker effectively has a passkey-backed session without ever cracking anything.
This is genuinely important to understand correctly, because it’s easy to draw the wrong lesson from it. The lesson isn’t “passkeys don’t work.” Passkeys still eliminate the entire category of attack they were built to eliminate, credential theft via fake login pages, password reuse, and brute force attempts. The lesson is narrower and more useful: any security control, no matter how strong the underlying technology, still has a human process wrapped around it, and that process is where attackers go next once the technology itself becomes too hard to break directly.
Why this keeps happening with every new security control
There’s a pattern worth naming here, because it isn’t unique to passkeys. Multi-factor authentication solved the password-only problem, and attackers responded with MFA fatigue attacks, bombarding users with approval requests until one gets accidentally approved. Passkeys solve the phishable-credential problem, and attackers responded by targeting the enrollment and recovery flow instead.
This isn’t a reason to distrust new security technology. It’s a reason to expect that the target simply moves. Whatever control a business adopts, the next weak point is usually the human process that surrounds it, not the technology itself.
What this means for businesses using Microsoft cloud services
If your business runs on Microsoft 365 or Azure, and has adopted or is planning to adopt passkeys, the specific gap worth understanding is around account recovery and device enrollment. These are moments that happen infrequently enough that most employees don’t have strong instincts about what a legitimate request looks like versus a fraudulent one, which is exactly why attackers target them.
The practical response isn’t abandoning passkeys, they’re still a meaningfully stronger foundation than passwords. It’s making sure the enrollment and recovery process itself has real verification steps built in, not just relying on the strength of the passkey technology to cover a process that was never actually hardened.
Where to start
Most businesses adopted passkeys, if they have at all, as a technology decision, flip the setting, done. Few have looked specifically at what happens during account recovery or new device enrollment, because that part felt like an implementation detail rather than a security decision.
It isn’t a detail. It’s exactly where this attack lives. If your business has rolled out passkeys, or is about to, it’s worth having someone who understands both the technology and the process gaps take an honest look at your specific setup before assuming the passkey rollout alone closed the gap it was meant to close.
One Request connects you with a specialist who can assess exactly this kind of implementation gap for your environment.