FIDO2 Authentication Method Registration Correlated with Unmanaged Device Login

Lacey Cochrane@NullVectorX

•updated Jul 10, 2026•31•0•26

Detects a near-simultaneous correlation between a user registering a new FIDO2 authentication method and a login session from an unmanaged or non-compliant device. This behavioral pattern is often associated with adversary-in-the-middle or vishing attacks where an attacker tricks a user into registering an attacker-controlled security key to maintain persistent MFA access.