Report: Passkey security issues could allow account takeover

A Palo Alto Networks report found that attackers can take over accounts protected by passkeys (a password alternative using cryptography) if they first get malware onto a user's device, exploiting weaknesses in account recovery and onboarding processes rather than breaking passkey encryption itself. The attacks, called Pass-ta-key variants, can extract passkey private keys (the secret codes that unlock accounts) or trick authentication systems into granting access without the user's knowledge. Security experts stress the issue stems from how passkeys are implemented in real systems, not flaws in passkey technology itself.