Enterprise passkey security under threat from malware

Researchers at Palo Alto Networks discovered attacks called Pass-ta-key that exploit weaknesses in how passkeys (passwordless authentication methods that replace passwords) are implemented, not flaws in passkey technology itself. These attacks require malware to already be installed on a victim's device and can bypass user verification requirements and extract passkey private keys (the secret codes that unlock accounts). The core issue is that organizations implementing passkeys haven't properly validated security checks around onboarding, account recovery, and device trust workflows.