Security researchers, including work from SpecterOps, have documented at least 39 distinct methods that can undermine passkey authentication despite the underlying FIDO2 cryptography remaining secure. These techniques target the surrounding infrastructure rather than the cryptographic keys themselves, including browsers, operating systems, password managers, sync services, Bluetooth transport, and account recovery workflows. Many have working proof-of-concept tools, and some techniques are already surfacing in real-world attack activity.
bleepingcomputer.com
· 2026-09-04
Microsoft Entra now fully supports passkeys as a passwordless authentication method, with both device-bound and synced passkey options reaching general availability. The guide explains how passkeys work using the WebAuthn standard, where a private key stays on the user's device or synced service while a public key is stored in Entra ID.
emsroute.com
· 2026-09-02
Huntress researchers found phishing campaigns that trick victims into running a disguised but legitimate Faronics Deploy installer, often labeled as an Adobe file, which secretly enrolls their machine into an attacker-controlled management console. From there, attackers run PowerShell scripts to fetch additional tools and install ConnectWise ScreenConnect, giving them persistent remote access. Over 457 endpoints were targeted between July 21 and August 20 using fake invoice and tax-document lures.
bleepingcomputer.com
· 2026-09-01
Brave has released version 1.94 of its browser with a new Email Aliases feature that lets users create disposable email addresses for signing up to websites, while messages are still forwarded to their real inbox. The feature requires a free Brave Account and works separately from Brave Premium, with up to five aliases available at no cost before a paid tier removes that limit.
bleepingcomputer.com
· 2026-08-29
Researchers have identified a subscription-based phishing toolkit called NovaCookies that uses adversary-in-the-middle techniques to intercept live Microsoft 365 login sessions. Rather than just harvesting usernames and passwords, the kit captures session cookies, letting attackers bypass multi-factor authentication and take over accounts directly. It is being sold as a service for roughly $320 a month, making advanced phishing capability accessible to less-skilled criminals.
darkreading.com
· 2026-08-26
Researchers found threat actors uploading npm packages containing only a malicious HTML file disguised as a Cloudflare verification page. When mirrored by sites like UNPKG and npmmirror, these files become directly viewable in a browser under a trusted domain, redirecting victims to attacker-controlled sites. OX Security identified 24 such packages, following an earlier discovery in July involving a package called 'china_airlines'.
bleepingcomputer.com
· 2026-08-25
Threat intelligence firm SOCRadar has exposed AnonyMousKIT, a phishing-as-a-service platform active since early 2024 that automates theft of Apple Activation Lock codes needed to unlock stolen iPhones. The operation spans 506 domains and 168 reseller storefronts, and uses AI-driven voice calls impersonating Apple to trick victims into handing over unlock credentials, iCloud data, and Keychain passwords.
bleepingcomputer.com
· 2026-08-25
GoKawiil