Anamika Dey, editor · By TechSun News Desk | techsunnews.com | September 7, 2026 | AI / Security / Trending | ~7 min read
| What This Article Covers
What actually happened: a September 4, 2026 security roundup documenting 39 distinct methods for attacking passkey-protected accounts. Why the underlying FIDO2 cryptography is not broken, even though passkey attacks are real. The difference between hardware-bound security keys and cloud-synced passkeys — and why it matters. Whether you should stop using passkeys (short answer: no) and what to actually do instead. |
You switched to passkeys because they promised a safer way to sign in — no passwords to remember, fewer phishing traps, and stronger protection against stolen credentials. Now, researchers have documented 39 new passkey attacks that can target passkey-protected accounts. So, are passkeys still safe, or are passkeys hackable after all? The short answer is yes, passkeys remain one of the strongest alternatives to passwords — but this new research shows where their surrounding software, synced accounts, and authentication flows can still be attacked.
But the research on passkey attacks is real, it’s recent, and it’s worth understanding what it actually says — because the honest answer sits in between “passkeys are perfect” and “passkeys are broken,” and neither of those extremes is where you should land.
What Actually Happened
On September 4, 2026, BleepingComputer published a roundup pulling together a wave of recent passkey-attack research from multiple security teams, cataloguing 39 distinct methods attackers have demonstrated against passkey-protected accounts. The report draws on work from several groups, including SpecterOps’ research into how Windows and WebAuthn authentication flows can be manipulated, and Palo Alto Networks’ Unit 42, which separately disclosed attacks against Google’s synced passkey system in Chrome, an approach it calls “Pass-the-Passkey.”
None of this is a single new vulnerability with one patch and one press release. It’s a consolidation of research that’s been building since roughly early August, now gathered into one number that makes for an alarming headline. That’s worth knowing before you panic — the “39” is a count of documented techniques across the whole passkey ecosystem, not 39 ways to crack any individual account remotely.
Passkeys Aren’t Broken — the Cryptography Still Holds
Here’s the distinction that matters most, and it’s one the researchers themselves are careful to make: not a single one of these 39 methods breaks the actual cryptography behind FIDO2, the standard passkeys are built on. A passkey is a public-private key pair. The private key is supposed to never leave your device or your password manager’s encrypted vault, and none of this research shows an attacker mathematically extracting that key from thin air.
What the passkey attack does show is that a passkey doesn’t live in a vacuum. It travels through a whole chain of trust before it does its job: the website, your browser, your operating system, your password manager, whatever cloud service syncs it across your devices, the enrollment process that set it up, and the recovery process that kicks in if you lose access. Attackers are going after the links in that chain, not the cryptography at its center.
Read next: What Is a Passkey? How to Go Passwordless in 2026 — if you want the fundamentals of how a passkey actually works before diving into the attack research.
What These New Passkey Attacks Actually Target
Rather than a flat list, it helps to think of passkey attacks in a few buckets.
Authentication prompt manipulation
Some techniques try to trick you at the moment you’re asked to approve a login — spoofing the prompt, flooding you with repeated requests hoping you’ll approve one out of frustration, or dressing up a fake prompt to look like the real thing. This category depends on you, the human, clicking approve on something you shouldn’t.
Attacks on synced, cloud-backed passkeys
This is where Unit 42’s research lives. Their Pass-the-Passkey attacks target Google’s synced passkey implementation in Chrome. In one path, malware already sitting on a Windows machine can examine the browser’s local sync database to identify which accounts you’ve protected with passkeys — and in some cases, recover the private keys tied to your synced passkeys. The key phrase there is “already sitting on a Windows machine.” This isn’t a remote attack; the device has to be compromised first.
Windows Hello and session-level abuse
SpecterOps’ research, published on GitHub as the “Pass-the-Passkey” family of attacks, showed that malware running inside an already-signed-in Windows session can, in some configurations, reuse a hardware-bound Windows Hello for Business key without prompting you for a fresh PIN or fingerprint check. Again, the starting point is a session that’s already been compromised — the attack extends that compromise rather than creating it from nothing.
Enrollment and account-recovery gaps
The last bucket targets the messier, more human parts of the system: how a new passkey gets added to your account, and what happens when you lose access and need to recover it. Weak recovery flows have always been a soft spot for any authentication method, and passkeys don’t automatically fix that just because the login itself is stronger.
Are Synced Passkeys Less Secure Than a Hardware Key?
In practical terms, yes — meaningfully so, though “less secure” doesn’t mean “unsafe.” A hardware security key (a physical device like a YubiKey) keeps your private key isolated on that one piece of hardware. It’s not reachable from your browser’s sync database, your cloud account, or malware running on your laptop, because it simply isn’t stored anywhere those things can reach.
A cloud-synced passkey trades some of that isolation for convenience: it follows you across your phone, laptop, and tablet automatically. That convenience is exactly why most people use it, and it’s also exactly what the newer research is probing. Don’t read this as “cloud passkeys are unsafe” — read it as “cloud passkeys inherit the security of your device and your cloud account,” which is a meaningfully different, more familiar risk than “anyone anywhere can guess or steal this.”
| Attack surface | Hardware security key | Cloud-synced passkey | Traditional password |
|---|---|---|---|
| Resistant to remote phishing | Yes | Mostly (prompt-level tricks possible) | No |
| Can be stolen by a data breach alone | No | No (needs more than the breach) | Yes |
| Vulnerable if malware is already on your device | Rarely | Yes (per Unit 42 research) | Yes |
| Depends on your cloud account security | No | Yes | No |
| Easy to recover if you lose your device | Harder | Easier | Easiest |
Should You Stop Using Passkeys?
No. That’s the clear answer, and it’s worth saying plainly instead of hedging it into mush. Passkeys still eliminate the attacks that have caused the most real-world damage for the last two decades: credential stuffing, phishing pages that harvest your typed password, and data breaches that expose a password you reused somewhere else. None of the 39 methods bring any of that back.
What they change is the threat model. With a password, a remote attacker who has never touched your device can still get in, just by guessing, buying leaked credentials, or running a convincing phishing page. With a passkey, most of these newer attacks require the attacker to already have malware on your machine or control of an already-open session — a much higher bar, and one where you have more warning signs and more defenses available.
What You Should Actually Do
- Keep your operating system and browser updated. Microsoft has said it applied mitigations on the Entra ID side for the passkey-relay issue SpecterOps reported, and separately patched a related Windows flaw, CVE-2026-34348 — an information-disclosure bug in the Windows Event Logging Service that’s part of the same broader hardening effort.
- For your highest-value accounts (primary email, banking, your password manager itself), consider a hardware security key instead of a synced passkey where the service supports it.
- Keep basic device hygiene in place — most of this research assumes a device that’s already compromised, so avoiding malware in the first place still does the heaviest lifting.
- Be suspicious of unexpected authentication prompts, the same way you’d be suspicious of an unexpected password-reset email.
- Don’t panic-abandon passkeys for passwords. That trade makes you less safe, not more.
That “device already compromised” starting point shows up a lot in security research right now — it’s the same underlying issue we covered in AI Assistants Are Starting to Act Without Asking — And Your Passwords May Be the Bigger Problem, where AI tools with standing access to your accounts raise a related risk.
| The Bottom Line
Thirty-nine new attack methods sounds like passkeys have failed. They haven’t. The core cryptography hasn’t been cracked — attackers are going after the software, sync services, and recovery flows built around it instead, and most of these techniques still require a device or session that’s already compromised. Passkeys remain safer than passwords for the vast majority of people. The real lesson here isn’t “avoid passkeys” — it’s that no single security feature, including this one, replaces basic device hygiene. |
Frequently Asked Questions
Are passkeys hackable?
In a narrow sense, yes — researchers have demonstrated real attacks. But none of them break the underlying FIDO2 cryptography. They target the software and services around a passkey, and most require the attacker to already have some level of access to your device.
Should I use a synced passkey or a hardware security key?
For most everyday accounts, a synced passkey through your phone or password manager is a big security upgrade over a password and is fine to keep using. For your most sensitive accounts — primary email, banking, your password manager — a hardware security key removes an entire category of the risks this research covers.
Do I need to change anything about my passkeys right now?
Not urgently. Make sure your devices and browsers are updated, and don’t approve any authentication prompt you didn’t just trigger yourself. There’s no need to delete or recreate existing passkeys because of this research.
Have you switched to passkeys yet, or are you still holding onto passwords for now? Tell us where you land in the comments — and what would make you trust passkeys more (or less).
| Editor’s Observation
What strikes me most about this story isn’t the number 39 — it’s how predictable this pattern is. Every time an industry ships a stronger version of something, security researchers immediately go looking at everything built around it instead of through it, because that’s usually where the real gaps are. We saw the same shape of story with two-factor authentication a few years back: the codes themselves weren’t broken, but the recovery flows and SMS delivery around them were. Passkeys are having their version of that moment now. It doesn’t mean the technology failed — it means the technology is mature enough that researchers have moved on to testing everything next to it. |
Sources and Further Reading
BleepingComputer — “39 New Methods That Compromise Passkey Authentication” (Sept. 4, 2026)
SpecterOps — Pass-the-Passkey attack research (GitHub)
Microsoft Security Response Center — CVE-2026-34348 advisory
FIDO Alliance — “FIDO Passkeys: Passwordless Authentication” (official documentation)
Internal links used: primary — “What Is a Passkey? How to Go Passwordless in 2026” (techsunnews.com/what-is-a-passkey/); secondary — “AI Assistants Are Starting to Act Without Asking — And Your Passwords May Be the Bigger Problem” (techsunnews.com/ai-agents-permission-passwords-security/), linked naturally near the compromised-device discussion.
