GOV.UK One Login is opening passkeys to more than 23 million users, letting them sign in without a password.
A new phishing kit enrolls attacker passkeys to keep access after password resets.
Malware can borrow Windows Hello for Business keys to open a 90-day persistence channel into Entra ID.
Unit 42 details three ways malware can abuse Chrome's synced passkey flows to hijack accounts.