/
← Voltar ao feed
medium

EvilTokens device-code phishing hit 344 orgs; passkey-themed lures bypass passkeys via other auth flows

1 fonte(s) · 1 atualização(ões) · publicado 14/10/2026 14:00 · coletado há 2 dias

Huntress argues that passkeys raise the bar for authentication but do not close the account lifecycle: attackers still target enrollment, recovery, compromised endpoints, alternative sign-in flows and social engineering. Huntress researchers tracked a device-code phishing campaign, EvilTokens, that hit 344 organizations across five countries in about 16 days. It was packaged as a phishing-as-a-service kit with AI-generated, role-tailored lures. Separately, Microsoft researchers documented attackers impersonating IT staff and urging employees to update their passkey or sign-in configuration. The passkey was only the lure, and one documented sequence involved non-phishing-resistant MFA. In neither case was passkey cryptography defeated.

Detalhes técnicos

  • Device code phishing: the attacker starts a legitimate device-code authentication flow, then emails the victim a lure that leads them to enter the code on a real Microsoft page. The victim completes MFA and the attacker obtains a valid session once the victim authorizes the attacker-controlled client. No password theft or malware is needed.
  • Passkey-themed phishing: the passkey is social-engineering bait that steers victims toward an exploitable authentication flow.
  • Enrollment and recovery abuse: an attacker can register an additional credential or exploit weak recovery or MFA-reset processes, leaving the original passkey untouched.
  • Endpoint-level attacks: SpecterOps research shows techniques that manipulate Windows WebAuthn interactions, including browser hooks that capture authentication responses or alter challenges. These require local execution or access to the authentication process.
  • Storage models: synced passkeys make the sync/recovery account part of the security perimeter. Device-bound passkeys reduce that dependency but add key distribution and replacement overhead.

Remediação

  • Define and enforce strong proof requirements for adding authenticators, replacing lost keys and resetting MFA, and monitor those actions.
  • Use phishing-resistant MFA (FIDO2/WebAuthn hardware keys); a hardware token that generates one-time codes does not give the same protection.
  • Ensure every device that signs in to company resources is managed and covered by an actively monitored EDR agent.
  • Train staff to use trusted enrollment routes, verify unexpected support requests via established channels, and stop on unexpected device code, biometric or security-key prompts.
  • Deploy ITDR to detect newly registered authentication methods, unusual access and abnormal mailbox/file activity.
  • On confirmed compromise, revoke sessions, remove unauthorized authenticators, and hunt for persistence such as inbox rules, OAuth app grants and forwarding addresses.

Linha do tempo

  1. huntress.com ↗ · pub. 14/10/2026 14:00 · coletado 20/10 16:30 primeiro registro

    EvilTokens device-code phishing hit 344 orgs; passkey-themed lures bypass passkeys via other auth flows

    ler a análise desta fonte

    Huntress argues that passkeys raise the bar for authentication but do not close the account lifecycle: attackers still target enrollment, recovery, compromised endpoints, alternative sign-in flows and social engineering. Huntress researchers tracked a device-code phishing campaign, EvilTokens, that hit 344 organizations across five countries in about 16 days. It was packaged as a phishing-as-a-service kit with AI-generated, role-tailored lures. Separately, Microsoft researchers documented attackers impersonating IT staff and urging employees to update their passkey or sign-in configuration. The passkey was only the lure, and one documented sequence involved non-phishing-resistant MFA. In neither case was passkey cryptography defeated.

    Technical Details

    • Device code phishing: the attacker starts a legitimate device-code authentication flow, then emails the victim a lure that leads them to enter the code on a real Microsoft page. The victim completes MFA and the attacker obtains a valid session once the victim authorizes the attacker-controlled client. No password theft or malware is needed.
    • Passkey-themed phishing: the passkey is social-engineering bait that steers victims toward an exploitable authentication flow.
    • Enrollment and recovery abuse: an attacker can register an additional credential or exploit weak recovery or MFA-reset processes, leaving the original passkey untouched.
    • Endpoint-level attacks: SpecterOps research shows techniques that manipulate Windows WebAuthn interactions, including browser hooks that capture authentication responses or alter challenges. These require local execution or access to the authentication process.
    • Storage models: synced passkeys make the sync/recovery account part of the security perimeter. Device-bound passkeys reduce that dependency but add key distribution and replacement overhead.

    Remediation

    • Define and enforce strong proof requirements for adding authenticators, replacing lost keys and resetting MFA, and monitor those actions.
    • Use phishing-resistant MFA (FIDO2/WebAuthn hardware keys); a hardware token that generates one-time codes does not give the same protection.
    • Ensure every device that signs in to company resources is managed and covered by an actively monitored EDR agent.
    • Train staff to use trusted enrollment routes, verify unexpected support requests via established channels, and stop on unexpected device code, biometric or security-key prompts.
    • Deploy ITDR to detect newly registered authentication methods, unusual access and abnormal mailbox/file activity.
    • On confirmed compromise, revoke sessions, remove unauthorized authenticators, and hunt for persistence such as inbox rules, OAuth app grants and forwarding addresses.