September 2, 2025

Researchers show how spoofing unsupported browsers can force users off passkeys, exposing Entra ID accounts to phishing and session hijack.  Who/What/When: On August 13, 2025, security researchers detailed a FIDO downgrade attack against Microsoft Entra ID that manipulates login flows to sidestep passkeys. Where/Why: By spoofing an unsupported browser, attackers trigger an error that removes…