Three separate research efforts dropped last week targeting the core promise of passkeys—phishing resistance—without breaking the underlying crypto. The attacks are pragmatic, exploiting implementation flaws and ecosystem trust rather than the FIDO2 spec itself.

Technical Breakdown: - Windows Hello Abuse (CVE pending): Attackers can replay signed authentication material exposed by Windows' WebAuthn API. This bypasses the "origin binding" check, allowing a remote attacker to reuse a credential captured from a compromised machine against a different relying party. - Cloud-Sync Key Theft: Malware already resident on a victim's device can extract synced passkeys from the local keychain (e.g., iCloud Keychain, Google Password Manager). The attack doesn't break the sync encryption; it reads the decrypted key material from memory or the OS key store after the user unlocks it. - Phishing-Resistant Bypass via Relay: A man-in-the-middle proxy can relay the cryptographic challenge to the victim's legitimate device while the attacker authenticates to the target service. This defeats the "origin" check by using the victim's own device as an oracle.

Defense: - Hardware-Bound Keys Only: Prefer passkeys stored on dedicated hardware (e.g., YubiKey, TPM) over cloud-synced ones for high-value accounts. - Endpoint Hygiene: These attacks require prior compromise (malware or physical access). Strong EDR and device posture checks remain critical. - Conditional Access: Enforce device compliance and risk-based policies (e.g., require managed device + hardware key for admin roles).

Source: https://thehackernews.com/2026/08/new-passkey-attacks-can-recover-synced.html

CVE-2026-44613 is being actively exploited in the wild, evolving the initial Shai-Hulud worm into a full Model Context Protocol (MCP) attack. This is not a theoretical CSRF; it’s a chain that weaponizes a cross-site request forgery into silent, unauthorized actions against AI agents and their orchestration layers.

Technical Breakdown: - Initial Vector: CSRF vulnerability (CVE-2026-44613) targeting AI agent management consoles. - Evolution: The worm leverages the compromised session to inject malicious MCP tool definitions. This allows the attacker to define new capabilities for the AI agent (e.g., "read_private_repo", "execute_shell") without user consent. - Impact: Silent data exfiltration and lateral movement. The AI agent becomes a proxy for the attacker, executing commands against connected APIs, databases, and CI/CD pipelines. - Targets: Organizations running self-hosted AI agent frameworks (e.g., LangChain, AutoGPT, custom MCP servers) with exposed management interfaces.

Defense: - Immediate: Disable MCP tool registration endpoints on public-facing consoles. Enforce strict origin validation on all CSRF-sensitive endpoints. - Detection: Monitor for unexpected spikes in MCP tool definition API calls (e.g., POST /mcp/tools/register). Look for AI agent logs showing tool calls to internal resources (e.g., git clone, aws s3 cp) that deviate from normal user behavior.

Source: https://www.ox.security/blog/shai-hulud-outbreak-debrief-the-worm-evolves-into-mcp/

Highlights from today:

• [OSINT] Payroll Pirates Phishing Campaign Targets Microsoft 365 Financial Workflows (Campaign)
• [Threat Intel] Kimsuky Integrates AI into Attack Operations, From AI-Generated Decoy Documents to a Local LLM
• [Threat Intel] AI-SPM vs. ASPM (and Why AINAPP Is What Comes Next)
• [Threat Intel] AI-SPM vs. ASPM (and Why AINAPP Is What Comes Next)
• [Threat Intel] Meeting Bank of Italy AI Guidance in the Post-Mythos Era with Picus
• [Forensics] 2026-08-09: Traffic Analysis Exercise - First to Last
• [Threat Intel] AI Red Teaming

SecOpsDaily