Affected Systems

Microsoft Windows 10, Windows 11, Windows Server (CVE-2026-34348); Microsoft Entra ID passkey validation; Google Password Manager synced passkeys in Chrome on Windows; Windows Hello for Business. Attacks require existing malware or authenticated unprivileged access on victim endpoints.

Exploitation Status

Proof-of-concept demonstrated by SpecterOps (Black Hat USA 2026), Unit 42, and independent researcher Dirk-jan Mollema. No evidence of active exploitation in the wild. Microsoft has patched CVE-2026-34348 and applied undisclosed Entra ID mitigations; Google removed Security Domain Secret from Chrome device logs but key remains in process memory.

Business Impact

Attackers with malware on endpoints or unprivileged authenticated access can bypass phishing-resistant MFA and impersonate users without breaking FIDO2 cryptography. SpecterOps chain allows privileged-user impersonation in Entra ID by replaying YubiKey signatures logged by Windows. Unit 42's Golden Pass-ta-key attack recovers private keys for all synced passkeys via a non-rotatable 32-byte master secret in Chrome memory. Mollema's technique uses Windows Hello for Business keys without fresh PIN/biometric prompts. Impact varies: replay attacks are session-limited; compromised Security Domain Secret persists indefinitely and exposes all synced passkeys.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Apply Microsoft security updates for CVE-2026-34348 (Windows Event Logging Service information disclosure) across Windows 10, 11, and Server estates immediately.
  • Review Windows Event Logs and Entra ID sign-in logs for anomalous passkey authentications from known user accounts, especially privileged accounts, originating from unexpected locations or devices.
  • Evaluate passkey deployment strategy: device-bound passkeys (YubiKey, Windows Hello for Business) mitigate synced-key extraction but remain vulnerable to replay and session abuse; synced passkeys (Google Password Manager) face master-secret compromise. Neither closes all attack paths when endpoint is compromised.
  • Enforce least-privilege access and conditional access policies in Entra ID that layer device compliance, IP restrictions, and session lifetime controls alongside phishing-resistant MFA.
  • Deploy EDR with memory scanning and API monitoring to detect unauthorized use of Windows cryptographic APIs (CNG/DPAPI) and Chrome process memory access targeting passkey material.