Threat Brief — 2026-08-03 — Passkeys aren't passwordless problems

Executive summary: A novel attack against passkey implementations reduces passwordless MFA to a single factor by exploiting relying parties that fail to validate the User Verified flag — a design gap that could undermine the industry's shift away from passwords. Meanwhile, automated doxing tools now assemble full personal profiles from leak data with zero OSINT skill, and Google quietly plans to exempt developers in sanctioned countries from Android verification, expanding the APK attack surface. On the analytical front, a column on dark patterns in vulnerability management metrics is worth a read for any team that dashboards its way into false security.

Top items

• Pass-the-Passkey: novel attack surface in passwordless authentication — Unit 42 research shows that when relying parties (RPs) fail to validate the UV (User Verified) flag in WebAuthn assertions, an attacker who obtains a passkey credential can authenticate without any biometric or PIN challenge, collapsing MFA to a single factor. This is a deployment-level flaw, not a protocol break, meaning any RP with lax assertion validation is silently weaker than password-based MFA. Security teams rolling out passkeys should audit their WebAuthn RP logic immediately. (src: Unit 42))

• One-click doxing: OSINT no longer required for mass harassment — New automated tools chain together leaked databases, social-media accounts, addresses, and geolocation from just a name, dropping the skill barrier for targeted harassment to near zero. This matters for executive protection and employee safety programs: the cost of personalised attacks has collapsed. (src: SecurityLab))

• Google to exempt sanctioned-country developers from Android verification — According to Google's own FAQ, devices in sanctioned regions will bypass mandatory developer verification, meaning users there can still install arbitrary APKs but local developers face no identity check. This widens the Android threat surface for trojanised apps originating from those regions. (src: Xakep))

• Dark patterns in vulnerability management metrics — An analytical piece examines how common KPIs (MTTR, vuln counts, scan coverage) can actively degrade security by incentivising closure of easy-but-low-risk findings while critical issues fester. Relevant for any SOC or AppSec team evaluating its own dashboards. (src: SecurityLab))

• AI platforms in the SOC — where Claude, Codex, and Cursor actually fit — A practitioner-oriented piece cuts through FOMO to map realistic use cases (detection writing, alert summarisation, incident drafting) and boundaries for LLM-assisted SOC workflows. Useful for teams weighing tool adoption. (src: The Hacker News))

• Pascal Caversaccio (SEAL 911 co-founder) joins Ethereum Foundation board — A well-known smart-contract security researcher takes a one-year voluntary seat, bringing incident-response expertise to EF governance. Low immediate operational impact but signals continued security-first direction for the Foundation. (src: Xakep))

Themes

Authentication trust assumptions under pressure: The passkey finding joins a growing pattern this fortnight — from device-code phishing at industrial scale to Russia's SMS-only authentication mandate — where the industry is discovering that "passwordless" and "MFA" are not synonyms for "unphishable." The weak link is consistently implementation, not protocol.

Automation lowering the bar for offence: Doxing-as-a-service tools and the continued evolution of AI-assisted malware (per ESET's recent report) share the same trajectory: capabilities that required expertise six months ago now need only intent. Defensive playbooks that assume skilled adversaries may need recalibration for high-volume, low-skill attacks.