FIDO Downgrade Attack Hits Microsoft Entra ID
September 2, 2025
Researchers show how spoofing unsupported browsers can force users off passkeys, exposing Entra ID accounts to phishing and session hijack.
Who/What/When: On August 13, 2025, security researchers detailed a FIDO downgrade attack against Microsoft Entra ID that manipulates login flows to sidestep passkeys.
Where/Why: By spoofing an unsupported browser, attackers trigger an error that removes…