{"id":14478,"date":"2025-07-21T12:11:49","date_gmt":"2025-07-21T12:11:49","guid":{"rendered":"https:\/\/newestek.com\/?p=14478"},"modified":"2025-07-21T12:11:49","modified_gmt":"2025-07-21T12:11:49","slug":"poisonseed-outsmarts-fido-keys-without-touching-them","status":"publish","type":"post","link":"https:\/\/newestek.com\/?p=14478","title":{"rendered":"PoisonSeed outsmarts FIDO keys without touching them"},"content":{"rendered":"
\n
\n
\n
\n
\n
\n
<\/div>\n<\/section>\n

PoisonSeed, the notorious crypto-hacking attack group known for large-scale phishing campaigns, was seen cracking Fast Identity Online (FIDO) protections in a novel social engineering technique.<\/p>\n

In a campaign discovered by Expel, the infamous supply chain phishing attackers<\/a> leveraged the cross-device sign-in feature available with FIDO keys.<\/p>\n

FIDO keys use hardware-based multi-factor authentication to address vulnerabilities found in other MFA methods<\/a>.<\/p>\n

\u201cIf a user whose account is protected by a FIDO key enters their username and password into the phishing page, their credentials will be stolen, just as any other user,\u201d Expel researchers in a blog post. \u201cBut with a FIDO protecting their account, the attackers are unable to physically interact with the second form of authentication.\u201d<\/p>\n

PoisonSeed attackers seem to have cracked this with a new trick. Instead of stealing or cloning a FIDO key, the attackers just convince users to scan a QR code, an exact copy of the QR prompted in a legitimate cross-device sign-in, that completes the malicious login for them.<\/p>\n

\u201cThis is a fun attack, and one we all need to instrument for,\u201d said Trey Ford, chief information security officer at Bugcrowd. \u201cYes, this is doable, and what we need to keep in mind is that every security control, on some level, will have failure modes.\u201d<\/p>\n

<\/a>Cross-device convenience becomes the crosshair<\/h2>\n

The PoisonSeed technique is exploiting a little-understood feature of many identity platforms, QR-code-based cross-device sign-in. Attackers use a fake login page, often mimicking Okta or similar providers, that presents a QR prompt after a password entry. When the user scans this QR with a legitimate authenticator app, it completes the session, but for the attackers.<\/p>\n

\u201cCredentials were captured with a fake Okta page, which were then used to invoke the cross-device sign-in workflow that presents a QR code meant for legitimate secondary devices,\u201d explained Jason Soroko, senior fellow at Sectigo. \u201cThe phishing site mirrored this code back to the user who scanned it with an authenticator app, which completed the FIDO challenge, even though the physical key never moved.\u201d<\/p>\n

This maneuver gave the adversary an active session while the key stayed safe in the victim\u2019s pocket, which proves that social engineering remains the soft underbelly, he added.<\/p>\n

Soroko has recommended turning off cross-device sign-in where possible and watching for unexpected device registrations or unusual geographies.<\/p>\n

<\/a>FIDO isn\u2019t broken, just outsmarted<\/h2>\n

Expel researchers called<\/a> the campaign a concerning development, given that FIDO keys are often regarded as one of the pinnacles of secure MFA. \u201cWhile we haven\u2019t uncovered a vulnerability in FIDO keys, IT and SecOps folks will want to sit up and take notice,\u201d they said. \u201cThis attack demonstrates how a bad actor could run an end-route around an installed FIDO key.\u201d<\/p>\n

Experts unanimously echoed Expel\u2019s concerns. Darren Guccione, CEO and co-founder at Keeper Security, said, \u201cThese attacks aren\u2019t cracking FIDO\u2019s cryptography \u2013 instead, they exploit trusted alternative login methods, like QR-based sign-ins, to trick users into unintentionally initiating legitimate login sessions that are controlled by the attacker.\u201d<\/p>\n

FIDO\u2019s strength lies in its hardware-backed protection, which remains incredibly resilient, he added.<\/p>\n

J Stephen Kowski, field CTO at SlashNext, offered a different solution. \u201cOrganizations should definitely take this seriously and consider implementing additional safeguards like requiring Bluetooth proximity between devices during cross-device authentication, while also ensuring their security solutions can detect and block these sophisticated phishing attempts before they reach users,\u201d he said. For users who absolutely need to have FIDO cross-device sign-in turned on, Expel recommends properly checking if sign-in requests came from suspicious locations and looking for registration of unfamiliar, unexpected, or untrusted keys.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

PoisonSeed, the notorious crypto-hacking attack group known for large-scale phishing campaigns, was seen cracking Fast Identity Online (FIDO) protections in a novel social engineering technique. In a campaign discovered by Expel, the infamous supply chain phishing attackers leveraged the cross-device sign-in feature available with FIDO keys. FIDO keys use hardware-based multi-factor authentication to address vulnerabilities found in other MFA methods. \u201cIf a user whose account… <\/p>\n

Read More<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-14478","post","type-post","status-publish","format-standard","hentry","category-uncategorized","is-cat-link-borders-light is-cat-link-rounded"],"_links":{"self":[{"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/posts\/14478","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=14478"}],"version-history":[{"count":0,"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/posts\/14478\/revisions"}],"wp:attachment":[{"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=14478"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=14478"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=14478"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}