Comment Comment by autoexec > The only sense in which passkeys have anything to do with this at all is that the attackers used the word "passkey" in their emails.That's wrong. They attackers actually go on to create a real passkey that gives their device access to the compromised account.Accounts that are already protected by passkeys can still be vulnerable too. see:https://www.forbes.com/sites/zakdoffman/2025/08/28/yes-your-...https://www.esentire.com/blog/securing-passkeys-thwarting-au...https://unit42.paloaltonetworks.com/passwordless-authenticat... parent autoexec 25 days ago
That's wrong. They attackers actually go on to create a real passkey that gives their device access to the compromised account.
Accounts that are already protected by passkeys can still be vulnerable too. see:
https://www.forbes.com/sites/zakdoffman/2025/08/28/yes-your-...
https://www.esentire.com/blog/securing-passkeys-thwarting-au...
https://unit42.paloaltonetworks.com/passwordless-authenticat...