An article described a phishing kit that uses a browser-in-the-browser setup and reportedly attempts to register rogue passkeys for persistent access to compromised accounts. We cannot require fully managed devices, although that was my preferred approach. We have also dealt with delays in our security rollout and are now deploying passkeys while removing app-based MFA; other weaker authentication methods are already disabled. Would switching to passkey-only authentication prevent this kind of attack, or can an attacker-in-the-middle setup still intercept passkey authentication the way it can target app-based MFA?
1 Answer
A properly implemented passkey is tied to the legitimate website’s origin, so a fake browser window or phishing page cannot normally use it to authenticate to the real service. Moving to passkey-only authentication should therefore block the initial credential theft that would otherwise let an attacker register another passkey.
The important distinction is making passkeys the only authentication method. I was unsure whether this newer attack could intercept them like app-based MFA, but origin binding is what prevents the phishing site from successfully using the passkey.