| ▲ | aleksejs an hour ago | ||||||||||||||||
The article describes a straightforward phishing attack that works specifically against accounts that are _not_ protected by passkeys: > Depending on which multi factor method the account uses, the victim sees a matching fake screen, whether a one time code prompt, an authenticator app number match, or an SMS page. The only sense in which passkeys have anything to do with this at all is that the attackers used the word "passkey" in their emails. When a phishing campaign with the subject line "Your Mailbox is Full, Log In to Fix Now!" succeeds, that does not demonstrate an interesting vulnerability inherent to your mail server's mailbox size limits. | |||||||||||||||||
| ▲ | autoexec an hour ago | parent [-] | ||||||||||||||||
> The only sense in which passkeys have anything to do with this at all is that the attackers used the word "passkey" in their emails. That's wrong. They attackers actually go on to create a real passkey that gives their device access to the compromised account. Accounts that are already protected by passkeys can still be vulnerable too. see: https://www.forbes.com/sites/zakdoffman/2025/08/28/yes-your-... https://www.esentire.com/blog/securing-passkeys-thwarting-au... https://unit42.paloaltonetworks.com/passwordless-authenticat... | |||||||||||||||||
| |||||||||||||||||