Executive Summary
Published 7/26/2026, 9:49:44 PM
Recent account takeovers on X (formerly Twitter) involving passkey bypasses have primarily targeted the "connective tissue" of the authentication process—such as browser extensions, domain migration policies, and fallback mechanisms—rather than the underlying FIDO2/WebAuthn cryptography itself.
Executive Summary
Attackers have successfully bypassed X's passkey protections using four primary methods: malicious browser extensions that intercept registration calls, domain migration exploits during X's transition from twitter.com to x.com, BLE-based phishing (CVE-2024-9956), and downgrade attacks that force users into weaker authentication fallbacks like SMS.
Primary Bypass Mechanisms
| Attack Vector | Technical Mechanism | Impact on X Users |
|---|---|---|
| Browser Extension Injection | Malicious extensions intercept WebAuthn API calls to forge registrations or force re-enrollment. | Allowed attackers to register their own passkeys as "backdoors" without user biometrics [Source: https://www.prnewswire.com/news-releases/breaking-the-passkey-promise-squarex-discloses-major-passkey-vulnerability-at-def-con-33-302540177.html]. |
| Domain Migration Abuse | Exploited the cryptographic binding of passkeys to specific domains during X's move to x.com. | Users were phished into "re-registering" on fake domains during the Nov 2025 migration window [Source: https://www.theregister.com/2025/11/05/x_domain_migration_passkeys/]. |
| CVE-2024-9956 (BLE Phishing) | Exploited FIDO:/ URI intents in mobile browsers to intercept signatures via Bluetooth Low Energy. | Attackers within 100m could hijack passkey sessions if the victim visited a malicious page [Source: https://cybersecpentesting.com/fido2-bypass-techniques-2026/]. |
| FIDO2 Downgrade | Manipulating the login flow to force the platform to offer "fallback" methods (SMS/Email OTP). | Bypasses passkey security entirely by reverting to phishable legacy methods [Source: https://cybersecpentesting.com/fido2-bypass-techniques-2026/]. |
Key Vulnerabilities Exploited
- XSS Backdoor Registration: Research indicates that Cross-Site Scripting (XSS) vulnerabilities allow attackers to silently register their own passkey to a victim's account. Once an attacker's passkey is added, it acts as a persistent backdoor that cannot be blocked by the user's own biometrics [Source: https://scotthelme.co.uk/passkey-security-risks/].
- The "FIDO Intent" Flaw: Before being patched in early 2025, mobile browsers allowed web pages to trigger system-level authentication intents. Attackers used this to "request" a passkey signature from a victim's device and receive it on an attacker-controlled device nearby.
- Recovery Flow Exploitation: As passkey adoption increased, attackers shifted focus to "Account Recovery" flows. By intercepting "magic links" or exploiting weak security questions, attackers could remove a victim's legitimate passkey and replace it with their own.
X-Specific Context: The x.com Migration
In late 2025, X's transition to the x.com domain invalidated many hardware security keys (like YubiKeys) because passkeys are cryptographically bound to a specific domain. This created a massive "re-enrollment" window that attackers exploited by:
- Sending fake "Action Required: Re-enroll your Passkey" emails.
- Directing users to lookalike domains (e.g.,
x-security.com). - Capturing initial login credentials to attempt a recovery-based bypass on the legitimate site [Source: https://www.theregister.com/2025/11/05/x_domain_migration_passkeys/].
Conclusion
While passkeys remain significantly more secure than passwords, they are not infallible. Most successful "bypasses" on X have resulted from platform policy failures (allowing weak fallbacks) or client-side compromises (malicious extensions) rather than a direct crack of the FIDO2 protocol. The transition to the x.com domain provided a unique, high-leverage window for social engineering that bypassed the technical benefits of passkey hardware binding.