Authentication mechanisms have evolved significantly over the past decade, yet social engineering remains one of the most effective attack vectors against even sophisticated systems. Recent campaigns demonstrate that passkey-based authentication, promoted as a phishing-resistant alternative to password-based login, is not immune to well-crafted social engineering attacks when combined with infrastructure abuse.
The Campaign Structure and Infrastructure Abuse
Threat actors conducting these campaigns leveraged third-party email delivery infrastructure to distribute over a million fraudulent messages in a coordinated push across a short timeframe. This approach offers attackers several operational advantages: it obscures their originating infrastructure, distributes the sending load across legitimate email services, and increases message delivery rates by avoiding reputation filtering on their own IP ranges.
The use of compromised or abused email infrastructure is not new, but its application to passkey-targeted phishing represents an evolution in attack sophistication. Rather than attempting to steal passwords directly, attackers focused on social engineering victims into authorising passkey registration or transfer through fake identity verification flows. This shift reflects attacker understanding that modern authentication practices have made password compromise less reliable.
Why Passkey Authentication Remains Vulnerable to Social Engineering
Passkey systems (typically WebAuthn or FIDO2-based) eliminate several attack vectors: they cannot be phished in the traditional sense because credentials are cryptographically bound to specific domains, and they resist credential stuffing and brute-force attacks. However, they do not eliminate the human element of authentication approval.
An attacker who convinces a user that they are undergoing legitimate account verification or security remediation can still trick them into approving a passkey registration on an attacker-controlled device. The victim then grants access to their cloud account whilst believing they are securing it. This is fundamentally a social engineering problem, not an authentication technology problem.
The campaign specifically mimicked CEO impersonation and financial fraud scenarios—high-stakes social contexts designed to trigger urgency and reduce scrutiny. Combined with spoofed or legitimate-appearing email headers and domains, these messages created sufficient credibility for a percentage of recipients to engage.
Infrastructure and Detection Implications
For infrastructure operators and cloud administrators, the key takeaway is that no single authentication mechanism eliminates social engineering risk. Passkeys do reduce the attack surface for credential theft, but they shift the threat model towards account takeover through authorisation abuse.
Defensive priorities should include:
- Monitoring for unusual passkey registration events, particularly those preceded by email alerts or notifications the user did not initiate
- Implementing geolocation and device-context checks for passkey operations—a legitimate user approving a passkey from an unexpected geography or device type warrants investigation
- Detecting anomalous email infrastructure patterns; bulk phishing campaigns often show distinctive sending patterns across mail systems
- User training emphasising that legitimate account security requests will never come via unexpected email, and that passkey approval flows should only occur within intentional security workflows
Further technical details are available from security researchers covering this campaign, including indicators of compromise and email headers used in the attack.
Broader Implications for Cloud Security Posture
These campaigns highlight a fundamental principle in security: authentication technology is a control layer, not a complete defence. The most robust cloud environments combine strong authentication with detection, response, and user behaviour analytics. A compromised passkey is still a compromised account, even if the technical attack vector differs from password theft.
Organisations running hosted applications or infrastructure should assume passkey compromise is possible and implement additional signals to detect it: unusual API calls, resource modifications, or data access patterns following successful authentication. This layered approach—strong authentication plus behavioural monitoring—offers significantly better protection than authentication mechanism alone.
