The New Target: How Malware Is Exploiting Synced Passkeys
Passkeys were designed to eliminate phishing risk, but new malware strains are targeting the devices and cloud accounts that sync them. Learn how this shift changes the threat model and what companies should do to secure passkey adoption with LENET’s practical guidance.
Passkeys have been promoted for several years as the eventual replacement for passwords, built on the premise that they cannot be phished the way a typed password can. There is no shared secret for an attacker to trick someone into revealing. Recent malware developments are testing that premise directly. Security researchers have identified malware capable of stealing synced passkeys, extracting the credential material from a compromised device rather than tricking a user into handing it over.
This does not mean passkeys have failed as a security improvement. It does mean the specific threat model has shifted, and companies rolling out passkey adoption need to understand where the new exposure actually sits.
Why Passkeys Were Considered Phishing Resistant
A traditional password is a shared secret. The user knows it, and the service verifying login also stores a version of it. Anything a user can be tricked into typing into a fake login page, an attacker can capture and reuse. Passkeys work differently, using cryptographic key pairs where the private key never leaves the user's device or its associated secure storage. There is no secret to type, and consequently no login form to fake convincingly enough to capture it.
This design defeats the overwhelming majority of phishing attacks, which rely on tricking someone into entering credentials on a fraudulent site. It does not defeat every attack that could compromise the device or account holding the passkey in the first place.
Where the New Risk Actually Sits
The malware identified in recent research does not attack the passkey protocol itself. It targets the device and the sync mechanism that makes passkeys convenient to use across multiple devices. Passkeys synced through a cloud account, so a user can log in from a phone, laptop, and tablet without re-enrolling each device, are stored somewhere accessible to that sync mechanism. Malware that compromises the device or the account managing that sync can potentially access the passkey material directly, without needing to trick the user into a phishing page at all.
This shifts the relevant threat from credential phishing to device and account compromise, a different problem requiring different defenses. A company that adopted passkeys specifically to eliminate phishing risk, without also addressing endpoint security and account protection for the sync mechanism, has closed one door while leaving another open.
What This Means for Companies Adopting Passkeys
Passkey adoption remains a meaningful security improvement over passwords, and this development does not change that overall direction. It does mean passkeys should be deployed as part of a broader security posture, not as a standalone fix that removes the need for other controls.
Endpoint security matters more, not less, in a passkey environment. If a passkey's protection depends on the security of the device storing it, a compromised device undermines that protection regardless of how strong the cryptography is.
The account managing passkey sync deserves the same protection as any other high-value credential. If a cloud account can grant access to synced passkeys, that account needs strong authentication and monitoring in its own right, since compromising it becomes a path to compromising every passkey it manages.
Practical Steps
Maintain strong endpoint protection, including updated malware detection, on any device used to authenticate with passkeys. Passkey security is only as strong as the device holding it.
Secure the account that manages passkey sync with its own strong authentication, since this account becomes a high-value target once it holds the keys to other credentials.
Monitor for unusual device enrollment or sync activity on accounts managing passkeys, similar to monitoring for unusual login activity on any other sensitive account.
Continue layering additional controls, including conditional access policies that consider device health and location, rather than treating passkey adoption alone as a complete authentication strategy.
Stay current on guidance from passkey providers as this threat develops. The response to device and sync-based attacks is likely to evolve quickly given how central passkeys have become to authentication roadmaps across the industry.
The Underlying Lesson
No single authentication method removes risk entirely. Passkeys close off a major attack path that passwords left wide open, and that improvement is real. The device and account infrastructure supporting them still needs the same security discipline applied to everything else in the environment.