Why Passkey Implementations Are Failing in 2026 [Prime Cyber Insights]

retained copy

Why Passkey Implementations Are Failing in 2026 [Prime Cyber Insights]

Welcome to Prime Cyber Insights. I'm Aaron. We are starting today with a reality check on the security of passkeys, a technology once heralded as the definitive solution to phishing. acting_description: professional, steady, welcoming speed: 1.0 trailing_silence: 0.3 And I'm Lauren. As it turns out, the cryptographic math isn't the failure point, Aaron. Research presented at Black Hat indicates that attackers are bypassing these protections by targeting the environment surrounding the keys. acting_description: measured, clear, responsive speed: 0.98 trailing_silence: 0.2 Specifically, SpecterOps demonstrated an exploit chain using CVE 2026 34348, where Windows stored past YubiKey signatures in cleartext. Combined with Entra ID validation weaknesses, this allows for the impersonation of privileged users despite phishing-resistant MFA. Simultaneously, Unit 42 found that local malware can extract the Security Domain Secret from Chrome's memory, effectively gaining the master key for all synced passkeys. acting_description: analytical, direct, focused speed: 1.0 trailing_silence: 0.4 It goes even deeper, Aaron. Researcher Dirk-jan Mollema found that malware within a compromised session can leverage hardware-bound Windows Hello for Business keys without triggering a fresh biometric prompt. This allows low-privilege processes to satisfy WebAuthn challenges and bypass conditional access rules. It proves that even hardware-bound keys are vulnerable if the session itself is compromised. acting_description: engaged, precise, thoughtful speed: 0.97 trailing_silence: 0.3 Looking at the tools behind these attacks, TechRadar reports that the North Korean group Kimsuky is adopting local AI tools like Ollama and GPT4All. By utilizing local LLMs, they bypass the safety monitoring typical of providers like OpenAI or Anthropic. They are leveraging these models for R-A-G environments and automated AI agent frameworks to scale their operations. acting_description: authoritative, methodical, neutral speed: 1.0 trailing_silence: 0.2 This shift toward local AI creates significant challenges for behavior-based detection, Aaron. We are also tracking infrastructure hijacking by the group Head Mare. They are exploiting two vulnerabilities in TrueConf servers, K-L-C-E-R-T-26-057 and 058, to deploy the PhantomCore backdoor via malicious installers. Kaspersky recently identified these campaigns targeting the electronics and energy sectors. acting_description: technical, discerning, deliberate speed: 1.0 trailing_silence: 0.3 That aligns with a broader trend of compromising update channels, Lauren. The HelloNet campaign follows a similar pattern, sideloading malicious DLLs into the ViPNet update binary. It's a precise method for maintaining persistence within sensitive government and transportation networks. acting_description: logical, objective, steady speed: 1.0 trailing_silence: 0.2 In response to local threats, Apple released an out-of-band update for macOS to address CVE 2026 65400. This vulnerability in Screen Sharing allows attackers on the same network to bypass authentication entirely. Given the implications for remote access, this is a high priority for enterprise patch management. acting_description: concise, alert, professional speed: 0.98 trailing_silence: 0.4 Finally, Kaspersky’s Q2 2026 threat report identifies Qilin as the most active ransomware group, accounting for nearly 15 percent of all victims on leak sites, followed closely by Akira. While the 400 million blocked attacks are significant, the real concern is the technical sophistication, including Qilin's recent use of zero-day exploits in VPN software. acting_description: factual, serious, composed speed: 1.0 trailing_silence: 0.3 It underscores that identity and endpoint security are no longer distinct silos but a single, unified attack surface. I'm Lauren. acting_description: balanced, insightful, measured speed: 0.95 trailing_silence: 0.2 And I'm Aaron. That concludes our briefing for August 10th, 2026. For technical deep dives and full transcripts, visit pci.neuralnewscast.com. Neural Newscast is AI-assisted, human reviewed. View our AI Transparency Policy at NeuralNewscast.com. acting_description: calm, resolute, direct speed: 1.0 trailing_silence: 0.5

Read disclosure