A PoisonSeed phishing campaign is bypassing FIDO2 security key protections by abusing the cross-device sign-in feature in WebAuthn to trick users into approving login authentication requests from fake company portals.

The PoisonSeed threat actors are known to employ large-volume phishing attacks for financial fraud. In the past, distributing emails containing crypto seed phrases used to drain cryptocurrency wallets.

In the recent phishing attack observed by Expel, the PoisonSeed threat actors do not exploit a flaw in FIDO2’s security but rather abuse the legitimate cross-device authentication feature.

Cross-device authentication is a WebAuthn feature that allows users to sign in on one device using a security key or authentication app on another device. Instead of requiring a physical connection, such as plugging in a security key, the authentication request is transmitted between devices via Bluetooth or a QR code scan.

The attack begins by directing users to a phishing site that impersonates corporate login portals, such as from Okta or Microsoft 365.

When the user enters their credentials into the portal, the campaign uses an adversary-in-the-middle (AiTM) backend to silently log in with the submitted credentials on the legitimate login portal in real-time.

The user targeted in the attack normally would use their FIDO2 security keys to verify multi-factor authentication requests. However, the phishing backend instead tells the legitimate login portal to authenticate using cross-device authentication.

This causes the legitimate portal to generate a QR code, which is transmitted back to the phishing page and displayed to the user.

When the user scans this QR code using their smartphone or authentication app, it approves the login attempt initiated by the attacker.

This method effectively bypasses FIDO2 security key protections by allowing attackers to initiate a login flow that relies on cross-device authentication instead of the user’s physical FIDO2 key.

Expel warns that this attack does not exploit a flaw in the FIDO2 implementation, but instead abuses a legitimate feature that downgrades the FIDO key authentication process.

To mitigate the risk, Expel recommends the following defenses:

• Limiting geographic locations from which users are allowed to log in and establishing a registration process for individuals traveling.
• Routinely check for the registration of unknown FIDO keys from unknown locations and uncommon security key brands.
• Organizations can consider enforcing Bluetooth-based authentication as a requirement for cross-device authentication, which significantly reduces the effectiveness of remote phishing attacks.

Expel also observed a separate incident where a threat actor registered their own FIDO key after compromising an account via what is believed to be phishing and resetting the password. However, this attack did not require any methods to trick the user, like a QR code.

This attack highlights how threat actors are finding ways to bypass phishing-resistant authentication by tricking users into completing login flows that bypass the need for physical interaction with a security key.

Microsoft says the April 2025 security updates are causing authentication issues on some Windows Server 2025 domain controllers.

The list of impacted platforms includes Windows Server 2016, Windows Server 2019, Windows Server 2022, and the latest version, Windows Server 2025.

However, as the company further explained, home users are unlikely to be affected by this known issue since domain controllers are typically used for business and enterprise authentication.

“After installing the April Windows monthly security update released April 8, 2025 (KB5055523) or later, Active Directory Domain Controllers (DC) might experience issues when processing Kerberos logons or delegations using certificate-based credentials that rely on key trust via the Active Directory msds-KeyCredentialLink field,” Microsoft said in a Windows release health update.

“This can result in authentication issues in Windows Hello for Business (WHfB) Key Trust environments or environments that have deployed Device Public Key Authentication (also known as Machine PKINIT).”

These problems could also impact software relying on these two features for authentication, including but not limited to third-party single sign-on (SSO) solutions, identity management systems, and smart card authentication products.

Affected auth protocols include Kerberos Public Key Cryptography for Initial Authentication (Kerberos PKINIT) and Certificate-based Service-for-User Delegation (S4U) via Kerberos Resource-Based Constrained Delegation (RBKCD or A2DF Delegation) or Kerberos Constrained Delegation (KCD or A2D2 Delegation).

Auth issues linked to CVE-2025-26647 security patches

According to Microsoft, these issues are linked to security measures designed to mitigate a high-severity vulnerability tracked as CVE-2025-26647 that can let authenticated attackers escalate privileges remotely by exploiting an improper input validation weakness in Windows Kerberos, which superseded NTLM as the new default auth protocol for domain-connected devices on all Windows versions released since Windows 2000.

“An attacker who successfully exploited this vulnerability could be assigned much greater rights by the Key Distribution Center to the certificate than intended,” Redmond explains.

“An authenticated attacker could exploit this vulnerability by obtaining a certificate containing the target Subject Key Identifier (SKI) value from a Certificate Authority (CA). The attacker could then use this certificate to get a Ticket Granting Ticket (TGT) for the target user from the Key Distribution Center (KDC).”

As a workaround, affected customers are advised to switch the AllowNtAuthPolicyBypass registry value in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Kdc from “2” to “1” as detailed in this support document.

Last month, Microsoft mitigated another known issue causing authentication problems on Windows 11 and Windows Server 2025 devices using the Kerberos PKINIT security protocol when Credential Guard is enabled.

Redmond also released emergency out-of-band (OOB) updates in November 2022 to fix a bug causing Kerberos sign-in failures and other auth problems on domain controllers.

One year earlier, it addressed authentication failures related to Kerberos delegation scenarios on Windows Server and similar Kerberos auth problems impacting domain-connected devices running Windows 2000 and later.