Passkeys Won’t Stop Authorization Phishing, What Leaders Need to Know

Why stronger login tools aren’t the end of the story

Businesses across Malaysia and the wider region have been rolling out passkeys and phishing‑resistant multi‑factor authentication (MFA) to protect remote access. The promise is simple: if a password is no longer used, attackers lose a common entry point. Yet a recent episode of the Risky Bulletin podcast (24 August 2026) revealed that criminals are shifting their focus to the next step, the authorization layer, and that device‑code phishing is on the rise.

What is device‑code phishing?

Device‑code phishing tricks a user into entering a short code on a legitimate service’s sign‑in page, while the attacker silently captures the code and uses it to approve a malicious login. The attack bypasses the strength of passkeys and even phishing‑resistant MFA because the user’s consent is harvested after the authentication step.

Passkeys and MFA can’t block the consent trick

Passkeys replace passwords with cryptographic keys stored on a device, and phishing‑resistant MFA adds a second factor that is hard to spoof. Both protect the authentication layer, the moment a user proves who they are. However, once authentication succeeds, the service still needs the user to authorize the session. Device‑code phishing targets that consent prompt, meaning the security gains of passkeys are partially neutralised.

Why attackers are moving up the chain

The more organisations adopt strong authentication, the fewer opportunities attackers have to steal passwords or replay credentials. As a result, they are looking for the next weakest link: the authorization step where a user clicks “Allow”. This shift is not speculative; it is an analysis from Luke Jennings, VP of Research at Push Security, that stronger authentication is pushing attackers toward the authorization layer.

Photo by Mikhail Nilov on Pexels

Practical steps to test your defenses

Defenders can no longer rely on checking only the login process. Here are three actions you can take now:

1. Simulate device‑code phishing, Run red‑team exercises that mimic the short‑code flow. Verify whether your security team or users can spot the abnormal consent request.
2. Monitor consent patterns, Look for spikes in authorisation events that originate from unfamiliar devices or locations. Anomalies often surface before a breach is confirmed.
3. Layer additional checks, Combine contextual risk analysis (device health, geolocation) with the consent prompt. If the risk score is high, require a second, out‑of‑band confirmation such as a push notification to a known device.

What this means for your security budget

Investing in passkeys and advanced MFA remains worthwhile; they still block the majority of credential‑theft attacks. However, you should allocate part of your budget to authorization‑layer monitoring and phishing‑simulation tools that cover the device‑code scenario. Push Security, the sponsor of the podcast, offers browser‑based detection that flags suspicious consent flows, but the core principle is to have visibility into every approval event.

Photo by Jakub Zerdzicki on Pexels

Bottom line

Stronger authentication does not eliminate phishing; it merely pushes the attack vector higher up the chain. By recognising the rise of device‑code phishing and testing your consent controls, you can keep the security advantage that passkeys provide while closing the new gap.

Terms used in this article

• Passkeys, Cryptographic credentials stored on a device that replace passwords for logging in.
• MFA (Multi‑Factor Authentication), A security method that requires two or more independent proofs of identity.
• Device‑code phishing, A phishing technique that steals a short authorisation code entered by a user on a legitimate sign‑in page.
• Authorization layer, The stage after authentication where a user explicitly approves a session or action.
• Authentication layer, The stage where a user proves their identity to a service.
• Browser‑based detection, Security software that runs inside a web browser to identify malicious activity.

Testing and hardening the authorisation layer against attacks like this is part of the identity and access work covered under managed IT services.