'PoisonSeed' Attacker Skates Around FIDO Keys

Expel published research claiming a phishing campaign called "PoisonSeed" used a cross-device QR-code flow to bypass FIDO/passkey protections and access accounts, but subsequently retracted the findings after community and FIDO Alliance review, concluding the evidence did not support the attack and noting properly implemented FIDO cross-device authentication (with proximity checks) would mitigate the technique.