Passkeys were designed to remove many of the weaknesses of passwords: shared secrets stored on servers, reusable credentials, and phishing flows that trick users into typing secrets into the wrong site. But BleepingComputer reports that researchers have now documented at least 39 methods, attack paths, research techniques, and exploitation scenarios involving passkeys and the infrastructure around them. The important point is not that all 39 methods are in active criminal use. BleepingComputer says some have proof-of-concept tools or published research, and some are already appearing in real-world attack patterns. The bigger shift is that the passkey attack surface is now being mapped publicly, giving defenders a more concrete list of failure modes to assess. The reported methods do not generally depend on breaking the cryptography inside FIDO2. Instead, they target the broader authentication ceremony: the web application, browser, operating system, password manager, cloud synchronization service, mobile device, Bluetooth transport, account recovery process, enrollment workflow, help desk, and the user approving the request. BleepingComputer cites techniques including assertion mining, assertion replay, circuit breaker attacks, assertion phishing, browser hooking, assertion capture, challenge injection, detour replay, user verification manipulation, and user presence manipulation. It also points to user-interface attacks such as passkey prompt flooding, credential interface deception, application metadata spoofing, window handle spoofing, remote desktop passkey phishing, and FIDO interface overlay attacks. One example in the report comes from SpecterOps’ “Pass the Passkey” research. According to BleepingComputer, SpecterOps showed that malware may not need to extract a private key. A malicious Windows application can allegedly use legitimate WebAuthn infrastructure to request a signed assertion; the user sees what appears to be a normal Windows authentication experience, completes verification, and the attacker receives the resulting assertion. That scenario preserves the core cryptographic promise of passkeys while still undermining the account flow. The private key does not leave its protected location, and the cryptography is not cracked. The compromise happens at the boundary between trusted authentication components, user prompts, and the application requesting access. For enterprises, the takeaway is narrower and more operational than “passkeys are broken.” The provided report supports a more specific conclusion: passkeys reduce several password-era risks, but they do not remove the need to secure enrollment, recovery, synchronization, device trust, prompt integrity, and user-verification paths. Who benefits: Organizations that treat passkeys as part of a broader identity architecture benefit most. The report specifically says dedicated biometric hardware can strengthen enterprise identity assurance. Who's exposed: Enterprises are more exposed if they treat passkey deployment as a complete fix for phishing and credential attacks. The weak points described in the report sit around the passkey ceremony, especially user prompts, recovery, enrollment, and compromised endpoints.