Passkey/Security Key Enrollment Following Suspicious Google Sign-In

Ibrahim Saud@tektrix

•updated Sep 23, 2026•1•0•2

Detects the enrollment of a new security key or passkey shortly after an unfamiliar or suspicious sign-in event within Google Workspace. This behavior is indicative of an adversary establishing persistent access following a successful session hijack or credential phishing campaign, specifically targeting authentication mechanisms to bypass existing security controls.