Enrollment and Account Recovery Abuse

SpecterOps shows malware getting valid passkey assertions out of Windows itself

BleepingComputer counts at least 39 published passkey attack methods. Most of the ones it names need code on the endpoint or control of a sync account first, and that is where the defensive work actually lands.