New Pass-ta-key attacks let malware hijack Google-synced passkeys

Published:

3 augustus 2026 om 23:58:01

Alert date:

4 augustus 2026 om 00:00:48

Source:

bleepingcomputer.com

Identity & Access, Web Technologies, Ransomware & Malware

Security researchers have identified three novel attack techniques dubbed 'Pass-ta-key' that allow malware running on already-compromised Windows devices to abuse Google Password Manager's passkey synchronization feature. The attacks enable threat actors to take over user accounts, bypass user verification mechanisms, and extract passkey private keys. The attacks target the synced passkeys stored and managed through Google Password Manager, which are designed to be a more secure alternative to passwords. Since the device is already compromised, the malware can interact with the passkey infrastructure in ways that circumvent the intended security model. This represents a significant concern as passkeys are increasingly adopted as a phishing-resistant authentication method. The research highlights that even next-generation authentication technologies can be undermined when endpoint security is compromised.

Technical details

Palo Alto Networks Unit 42 discovered three novel attacks collectively named 'Pass-ta-key' targeting Google Password Manager in Chrome on Windows devices with a Trusted Platform Module (TPM). All three attacks require malware already running on the victim's device and exploit weaknesses in how Chrome and Google's cloud authenticator handle device trust, onboarding, recovery, and synced credentials rather than breaking passkey cryptography.

1. Pass-ta-key: Unprivileged malware impersonates a trusted device by abusing Chrome's TPM-backed device identity key to sign a request to Google's cloud authenticator. The authenticator returns a signed assertion usable for login. The attack fails if a service properly validates the User Verified flag indicating biometric/PIN verification. Tested successfully against eBay (which did not properly validate the UV flag), but failed against GitHub. eBay has since patched the issue.

2. Silver Pass-ta-key: Malware forces Chrome to re-register with the cloud authenticator by invalidating the existing verification key or deleting the local passkey state file. During re-registration, the attacker registers a user-verification key they control because the cloud authenticator does not validate whether the new key originated from trusted hardware. Google then accepts assertions signed with the attacker's key as proof of user verification, enabling authentication from a different system without further access to the victim's device.

3. Golden Pass-ta-key (most severe): Malware extracts the security domain secret (SDS), the master key used to encrypt all passkeys synced through Google Password Manager. This key is temporarily sent to Chrome during device registration or recovery. It was initially found exposed in plaintext in Chrome's internal FIDO logs; Google removed it from logs after disclosure, but the SDS is still transmitted to Chrome and remains temporarily accessible in the browser's process memory. By forcing a re-registration and scanning Chrome's process memory, attackers can extract the SDS, decrypt all synced passkey private keys, transfer them to another system, and impersonate the victim. Google's current implementation reportedly provides no mechanism to rotate or revoke this master key, leaving current and future synced passkeys at risk.

Mitigation steps:

1. Websites should require AND properly validate the User Verified (UV) flag in passkey authentication assertions to prevent Pass-ta-key style bypasses.
2. Credential managers (including Google) should validate that newly registered device verification keys originate from trusted hardware during re-registration.
3. Google and credential managers should harden recovery and device re-registration processes to prevent malware from abusing them.
4. Google should prevent the security domain secret (master key/SDS) from being accessible in Chrome's process memory or transmitted in a way that allows extraction.
5. Google should implement a mechanism to rotate or revoke the security domain secret so compromised master keys can be invalidated.
6. Organizations should ensure endpoint security to prevent malware from running on devices where passkeys are stored, as all three attacks require an already-compromised device.
7. Monitor Chrome browser process memory access by unauthorized processes on Windows endpoints.
8. Until full mitigations are in place, consider using hardware security keys (non-synced passkeys) for high-value accounts as they are not affected by these cloud sync attacks.

Affected products:

Google Password Manager (Chrome on Windows with TPM)
Google Chrome (Windows)
Google Cloud Authenticator
eBay (user verification bypass - patched)