01 · Briefing · what happened

Even the 'unbeatable' login can be picked - so no single lock is the whole defence

Cybersecurity 4 min 14 sources

Three research teams showed how to defeat passkeys, the phone-and-fingerprint logins sold as phishing-proof - without breaking the maths, by owning the device underneath. Paired with a zero-day that emptied one company's customer list, it's the same lesson: bet everything on one lock and you lose everything when it fails.

3

research teams

each defeated passkeys a different way, all without breaking the cryptography

10/10

severity of the Metabase flaw

the worst possible score - full admin access, no login needed

1,500%

rise in device-code phishing

a trick that hijacks a real login screen, up this year

771 days to 4 hours

time from flaw known to exploited

2018 versus 2024 - the patching window has nearly vanished

At a glance

Three research teams showed how to defeat passkeys - the phone-and-fingerprint login sold as phishing-proof - without breaking the cryptography.
They didn't break the maths; they owned the device underneath. A passkey is phishing-resistant, not malware-resistant, and assumes a clean device.
Laptop maker Framework lost its customers' names, emails, phone numbers and addresses through a single unpatched flaw in an analytics tool, Metabase.
That flaw scored 10 out of 10 - the worst severity - letting an attacker gain full admin access and export everything connected to it.
For the first time, tricked or stolen logins have overtaken software flaws as the top way ransomware crews break in.
Many victims had a second login check turned on - just not everywhere, so attackers walked through the systems that lacked it.
Attackers now chain flaws together, and time-to-exploit has collapsed from 771 days in 2018 to four hours in 2024.
The defence everyone lands on: not a better single lock, but independent layers, so the failure of any one is caught by the next.

Forces in play

Trust in one lock High↓

passkeys proved beatable when the device beneath them is dirty; the second login check proved 'not sufficient on its own'

Identity as the front door Building↑

stolen and tricked logins overtook software flaws as ransomware's top entry; phishing calls doubled

Attack chaining speed High↑

time-to-exploit fell to four hours; fifteen TP-Link flaws chained into full network takeover

Layered defence Building↑

device trust, session watching and fast patching stacked so no single control carries the whole load

In play Palo Alto Unit 42 — built 'Pass-ta-key' - malware that recovers synced passkey private keys Framework — laptop maker whose customer list leaked via a Metabase zero-day Metabase — analytics tool with a 10/10 flaw exploited before a fix existed ChainDrop worm — hijacked one developer account, poisoned hundreds of shared code packages

Where this points

Watch whether defenders shift budget from chasing one perfect login toward layered signals - device health, session behaviour, fast patching; if identity stays the top break-in route, the single-lock mindset is the thing that has to change.

Full briefing

Passkeys are the login that was supposed to end this problem. Instead of a password you can be tricked into typing, they use a secret key locked to your phone or laptop. You unlock it with your face or fingerprint, so there is nothing to phish. Last week, three separate research teams showed how to defeat them anyway. [1]

None of them broke the cryptography. They went underneath it. Palo Alto Networks’ Unit 42 built an attack it calls “Pass-ta-key”: malware already sitting on a Windows PC reads Chrome’s local database and finds which accounts use passkeys. It then recovers the private keys for the ones synced to Google. [2] A second team, SpecterOps, reused signed login material to impersonate privileged users while still satisfying the “phishing-resistant” check. [1] A third researcher showed malware in a signed-in session using a hardware-locked Windows Hello key, without ever asking the user to unlock it again. [1]

The thread is the same: a passkey is phishing-resistant, not malware-resistant. It quietly assumes the device holding it is clean. When that assumption fails, the strongest single lock falls with it. This is not a reason to drop passkeys - they still beat passwords badly. It is a reason not to make any one control your whole defence.

The same lesson arrived as a plain breach. Framework, the modular-laptop maker, told customers an attacker stole their names, emails, phone numbers, physical addresses, and login locations. [3] The way in was a zero-day - a flaw with no fix yet - in Metabase, a data-analytics tool Framework used to run its business. [3] The flaw scored the worst possible severity, 10 out of 10. An unauthenticated attacker could feed the system commands it trusted, gain full administrator access, then read and export everything connected to it. [4] Metabase has since patched it. [5] One weak component, and the whole customer list walked out the door.

Across the industry, the front door itself is moving. For the first time, tricked or stolen logins have overtaken software flaws as the top way ransomware crews get in, one report found. [6] Many victims had a second check - called multi-factor authentication - in place. It just was not turned on everywhere, so attackers walked through the systems that lacked it. The report’s own conclusion: that second check “is not sufficient on its own.” [6] Meanwhile device-code phishing - a trick that hijacks a legitimate login screen - is up 1,500% this year, and voice-phishing scam calls have doubled. [7]

And attackers no longer beat one wall - they chain flaws together. The gap between a flaw becoming known and being exploited has collapsed from 771 days in 2018 to four hours in 2024. [8] Some flaws are now hit before a patch is even public, while the average fix for a critical flaw still takes over 60 days. Researchers this week chained fifteen flaws in TP-Link’s Omada network gear with two older ones to seize control of a whole network from outside it. [9] A worm called ChainDrop spread through the code-sharing world by hijacking a single developer’s account. It then poisoned hundreds of code packages other programs pull in - some downloaded two billion times a month. [10][11]

The answer defenders keep landing on is not a better single lock. It is layers that do not share a weakness: a strong login, plus watching the device it comes from, plus flagging a session that behaves oddly, plus patching fast. [12] Valid credentials should not be enough on their own without the right device behind them. [12] Cisco patched two dozen flaws this week, including critical ones in its firewalls; Chrome shipped critical fixes too. [13][14] Each is one more wall - and the point is that you keep several, because any one of them will eventually be the one that fails.

For an ordinary person, the takeaway is calm, not scary. Passkeys are still the best login you can use - keep them. But do not treat any one thing as your whole shield. Keep your devices patched and clean, turn on every check your accounts offer, and be suspicious of anything that rushes you. The strength was never one perfect lock. It is having more than one.

02 · Lesson · why it matters

The strongest lock was never the plan - having several was

A defence built on one perfect barrier fails the day that barrier fails. A defence built on independent layers survives it.

How it works

No single barrier is trusted to hold on its own
So you stack several independent layers
An attacker who beats one still faces the next
The layers must be independent - a flaw that beats one must not beat the next
Strength isn't any single wall; it's that all of them must fall

The twist

The strength of a defence is never its best lock - it's that an attacker has to beat every layer, and the layers don't share a weakness.

Where you've seen this

Medieval castles

a moat AND a wall AND a locked keep AND guards - because any one will eventually be breached

Aviation safety

checklists, alarms, backups and training stacked so no single failure downs the plane

Bank vaults

a time lock, a combination, a guard and cameras - each covers a gap the others miss

The catch

Layers only help if they're truly independent - passkeys plus a clean device look like two layers, but the passkey depends on the device, so a device breach takes both at once.

Full lesson

The lock that wasn’t enough

For years the security world has been trying to build a login you cannot be tricked out of. Passkeys were the answer: a secret tied to your device, unlocked with your face or fingerprint, with nothing to type and so nothing to phish. Then, in a single week, three teams of researchers showed how to defeat them.

Not one of them broke the underlying maths. They didn’t have to. They went at the thing beneath the passkey - the device holding it. Malware already on the machine read the keys, borrowed the login, and walked in. The lock was fine. The floor it stood on was not.

That is the whole story of security in one image. The best barrier anyone has built still assumed something quieter was true: that the ground under it was solid. When that turned out to be false, the strong lock fell as easily as a weak one.

Why you don’t trust one wall

There is an old answer to this, older than computers. A castle does not defend itself with a single great wall. It has a moat, and a wall, and inside that a locked keep, and guards walking the whole thing. This is not because the wall is weak. It is because the builders assumed, correctly, that any one defence would eventually be beaten. A long enough siege, a bribed guard, a dry summer that lowered the moat. So they made an attacker beat all of them.

Security people call this defence in depth, and it is less clever than it sounds. It is just refusing to bet everything on being right about one thing. You keep a strong login. You also watch the device it comes from. You also flag a session that starts behaving strangely. You also patch fast, so the window a flaw stays open is short. Each layer is imperfect. The point is that an attacker has to get past every one, and each covers a gap the others miss.

The breaches this week were all single-layer bets that lost. A company called Framework kept its customer list behind one analytics tool. When that tool had a flaw with no fix yet, the whole list left in one go. Ransomware crews now get in most often not through software flaws but through stolen logins, and many victims had a second check in place - just not on every system. The report that found this said the second check “is not sufficient on its own.” That sentence is the entire lesson.

The catch: the layers have to be independent

Here is the part that is easy to miss, and it is where the passkey story earns its place. Stacking layers only helps if a flaw that beats one does not also beat the next. Two locks on the same rotten door are not two layers - they are one.

The passkey and a clean device looked like two defences. They were not independent. The passkey relied on the device being trustworthy. So when malware owned the device, it did not have to beat two things. It beat one, and got both. Real depth means each layer stands on its own ground. The login, the device check, the session watch, and the patching all fail for different reasons, so no single break-in collects them all at once.

Where this shows up everywhere

Once you see it, you find it far from computers. A plane does not stay up on one system; it has checklists, alarms, backups, and trained pilots, stacked so no single failure ends the flight. A bank vault has a time lock and a combination and a guard and a camera - each catching what the others would miss. A doctor confirms a serious diagnosis with a second test, because one result can be wrong. In every case the safety is not in the best single guard. It is in the arrangement.

What holds you

You run this arrangement whether you notice it or not. Every account you own sits behind a stack you assembled without thinking of it as one. A password, maybe a second check, the device in your hand, your own wariness when something rushes you. The people defending banks and hospitals are doing the same thing you are, at larger scale and with the same limits. None of them can see, from any single seat, whether their layers are truly independent or quietly leaning on the same weak floor. That blind spot is shared, and you are inside it, not above it. The honest move is not to find the perfect lock. It is to keep more than one, and to keep asking which of them are secretly the same.

03 · Lab · your turn

Stack the layers

Rehearse building a defence out of independent layers, and feel why one strong lock alone - or two that share a weakness - leaves the door open.

04 · Hope · carry this

The week that showed our best single lock can be picked also showed the fix was never a perfect lock, but the plain habit of keeping more than one - something anyone can do.