Black Hat Exposes Pass‑the‑Passkey Attack: Windows Event Log Extraction and Replay of YubiKey Tokens

Attack Overview

At Black Hat USA 2026, researcher Milan Grafnetter of SpecterOps presented the “Pass‑the‑Passkey” family of attacks. The technique does not require stealing the physical YubiKey; instead it harvests the WebAuthn authentication statement that Windows records in its event log and replays it to Microsoft Entra ID.

Technical Mechanism

Windows logs detailed metadata for each WebAuthn authentication event. If an attacker obtains local code execution—through malware, a vulnerability, or social engineering—they can read these logs, extract fields such as the credential ID and signature, and feed them to the custom Passkey Injector tool, which sends the forged assertion to Entra ID.

Attack Steps

Local execution : Gain code execution on the victim machine.

Log extraction : Read the Windows event log and pull the most recent WebAuthn authentication record.

Replay : Use Passkey Injector to submit the extracted assertion to Entra ID, completing identity impersonation.

Impact

The attack bypasses multi‑factor authentication notifications because no physical key interaction occurs and the user’s PIN is not needed. It undermines the core promise of password‑less authentication—that possession of the hardware key is the sole required factor.

Mitigation Recommendations

Restrict read access to WebAuthn‑related event logs to privileged accounts only.

Monitor Entra ID sign‑ins for anomalous combinations of source IP, geographic location, and device fingerprint.

Combine hardware keys with biometric verification to raise the difficulty of replay attacks.

Track Microsoft’s forthcoming patches; SpecterOps has already disclosed the issue to Microsoft.

Full whitepaper: https://specterops.io/passkeys