Passkey Flaw Lets Malware Cut MFA to One Factor
Unit 42 discovered that many passwordless systems—especially Google’s synced passkeys—skip verification of the User‑Verified flag. Malware on a compromised device can then forge a passkey authentication, effectively reducing multi‑factor authentication to a single factor and hijacking accounts. The finding forces defenders to audit their passkey validation logic.