Back to today’s briefing

Story perspectives

New Phishing Technique Bypasses FIDO2 Security Keys

7/20/2025

40 7

Summary

Story summary

A new phishing technique uncovered by Expel researchers exposes a serious flaw in user behavior, as the PoisonSeed group cleverly bypasses FIDO2 security keys. By exploiting a legitimate cross-device login feature, attackers deceive users into scanning a QR code after entering their credentials on a counterfeit page, underscoring the urgent need for stronger security protocols.

1 of 1

Story summary

A new phishing technique uncovered by Expel researchers exposes a serious flaw in user behavior, as the PoisonSeed group cleverly bypasses FIDO2 security keys. By exploiting a legitimate cross-device login feature, attackers deceive users into scanning a QR code after entering their credentials on a counterfeit page, underscoring the urgent need for stronger security protocols.