Biometric login: fake IT calls hand scammers a work account

Explore the technical breakdown of the recent biometric enrollment compromise campaigns to understand how credential hijacking is evolving beyond legacy credential stuffing.

For years, authentication architecture has been shifting toward asymmetric cryptography. We replaced easily phished passwords with FIDO2/WebAuthn primitives, celebrating origin-bound public key credentials (navigator.credentials.get()) and hardware-backed biometric authenticators as the ultimate shield against credential theft.

However, recent threat intelligence exposes an architectural blind spot: the registration ceremony (navigator.credentials.create()).

When an adversary executes a voice-phishing (vishing) or Adversary-in-the-Middle (AitM) flow that directs an end user to a rogue portal, they are not attempting to break the WebAuthn cryptographic boundary. Instead, they exploit the bootstrap phase. By convincing the victim to authorize a new credential provisioning request, the attacker registers their own hardware authenticator's public key against the victim’s identity in the enterprise directory.

The Registration Ceremony Vulnerability

The vulnerability here is not mathematical; it is systemic identity proofing:

1. Bootstrap Weakness: WebAuthn is only as strong as the authentication factor used to authorize credential provisioning. If a user can authorize a new passkey using a legacy, phishable mechanism (such as basic push notifications or SMS OTP), the security baseline collapses to that weaker factor.
2. Telemetry Blind Spots: Most security orchestration systems evaluate risk during the login handshake. Once a fraudulent public key is enrolled into an identity provider, subsequent authentication events are cryptographically valid, bypass typical risk signals, and suppress anomalous sign-in alerts.
3. Session Persistence: Because FIDO2 keys are treated as high-trust, continuous authentication mechanisms, the attacker gains durable access to cloud environments without needing to steal biometric vectors or brute-force tokens.

Hardening the Enrollment Pipeline

For backend engineers, identity architects, and developers building secure computer vision and biometric comparison workflows, this attack vector highlights the need to decouple credential registration from standard user sessions:

• Attestation and Device Binding: Implement strict WebAuthn attestation verification on your relying party (RP) server to enforce corporate device tiers and block unauthorized authenticators.
• Rigorous Identity Verification (1:1 Comparison): Do not rely solely on transient session tokens during sensitive onboarding or recovery flows. Require out-of-band verification, such as direct 1:1 facial comparison against a verified identity record using precise Euclidean distance analysis, ensuring the person enrolling the key is the verified account holder.
• Temporary Access Pass (TAP) Enforcement: Restrict passkey registration behind short-lived, out-of-band admin credentials rather than self-service fallback prompts.
• Lifecycle Event Telemetry: Audit credential creation independently from authentication. Trigger automated quarantine protocols and alerts whenever a new public key is bound from an unrecognized IP space or user-agent profile.

Cryptographic authentication works, but if the enrollment bridge is unverified, you are simply securing the front door while handing out keys at the threshold.

How is your engineering team securing the WebAuthn and passkey enrollment ceremony against identity-proofing bypasses?