grep -rl "passkeys" ./articles
Microsoft says extortion groups tied to ShinyHunters and Helix are phoning staff about urgent passkey or single sign-on updates, then steering them into relayed sign-ins or device-code approvals. Once in, they register an MFA method of their own, map the tenant through Microsoft Graph and take files at under 1,000 an hour to stay unremarkable.
Abnormal found iAuthFlow V2 selling for $10,000 on Russian-language forums. During the phishing flow it silently registers an attacker-controlled passkey on the victim's account. Passkeys are independent of the password, so the standard remediation — reset, revoke sessions — leaves the intruder logged in.
Black Hat and the weeks around it produced three unrelated results against phishing-resistant authentication: replayable signatures in Windows event logs, a master key pulled from Chrome's memory, and Windows Hello keys used without a PIN prompt.