Misleading title. An honest one would be "What attackers are phishing instead of passkey credentials".