New Eucleak attack lets threat actors clone YubiKey FIDO keys

A side-channel vulnerability named EUCLEAK affects devices using the Infineon SLE78 security microcontroller (notably many YubiKey 5 Series, some YubiHSMs, Infineon TPMs, Optiga Trust M, and other products). The flaw enables extraction of ECDSA private keys via electromagnetic analysis, but exploitation requires extended physical access, specialized equipment, and high technical skill; Yubico rated the issue moderate (CVSS 4.9) and provides mitigations and affected firmware versions, noting limited risk to general users.