Microsoft will set passkeys as the default authentication method in Entra ID starting September 1, 2026, for users currently configured for SMS or voice multifactor authentication.
The rollout will begin immediately for users configured for SMS or voice MFA, with automatic passkey enablement and prompts to register during sign-in. Microsoft will disclose pricing, commercial terms, and supported telecom providers on September 18, 2026. It will also require remaining SMS or voice users to choose an approved telecom provider through the Microsoft Security Store by October 30, 2026. The company’s native telecom delivery will end on February 1, 2027, forcing all users to adopt passkeys or another approved method.
Huntress reports that a phishing‑as‑a‑service campaign called EvilTokens targeted 344 organizations across five countries in about 16 days, obtaining valid sessions without stealing passwords or breaking passkey cryptography. The campaign used device-code phishing, a technique that bypasses traditional authentication flows.
Another incident highlighted by Huntress involved attackers impersonating IT staff to trick employees into updating their passkey or sign-in configuration. Microsoft researchers found that the passkey itself served as a lure, while attackers pursued other authentication flows, including non-phishing-resistant MFA. This underscores how attackers adapt to new security measures by targeting enrollment, recovery, or help-desk processes rather than the underlying cryptography.
Research from SpecterOps, cited by Huntress, shows that malicious Windows applications can manipulate WebAuthn (a web authentication standard) interactions—such as browser hooks—to capture or alter authentication responses without extracting the private key. This highlights the need for robust endpoint protection even after passkey deployment, as attackers can exploit vulnerabilities in the broader authentication ecosystem.
Passkeys can be stored in two ways: as synced credentials in cloud-backed accounts (such as platform keychains or password managers) or as device-bound credentials on a single hardware token. Each method presents different dependencies for enrollment, recovery, and endpoint protection. For example, cloud-synced passkeys rely on secure storage and synchronization, while hardware tokens reduce attack surfaces by limiting exposure to multipurpose devices.
BleepingComputer documented at least 39 publicly known methods, attack paths, and exploitation scenarios involving passkeys and their surrounding infrastructure. Many of these techniques involve manipulating enrollment, recovery, or help-desk processes rather than directly breaking the FIDO2 cryptography (a standard for passwordless authentication). One method involves malicious Windows applications invoking legitimate WebAuthn infrastructure to generate signed assertions, allowing attackers to receive authentication responses while the private key remains protected.
Dedicated biometric hardware, such as standalone authentication tokens, reduces the attack surface compared to passkeys stored on multipurpose devices like smartphones or laptops. These hardware tokens lack general-purpose operating systems, browsers, or screens, making them less vulnerable to exploits targeting broader device functionality.
To mitigate risks, Huntress recommends security awareness training that teaches users to recognize trusted enrollment routes, verify unexpected support requests through established channels, and protect hardware keys and recovery options. Prompt reporting of suspicious activity is also critical. Additionally, identity threat detection and response (ITDR) tools can help defenders identify and contain suspicious activity around legitimate sign-ins by monitoring signals such as unusual access, newly registered authenticators, or abnormal cloud activity.
Proofpoint research, cited by Redmondmag, shows that attackers spoof OAuth client IDs to list accounts without registered applications. One campaign targeted over 1 million accounts across nearly 4,000 tenants, while another targeted over 2 million users using 3.7 million spoofed application IDs.
Join the discussion