Malware sitting quietly on a compromised Windows PC can now hijack Google’s synced passkeys and seize full control of an account without ever prompting the victim for a password, PIN, or fingerprint.
Arie Olshtein at Palo Alto Networks’ Unit 42 disclosed three attack techniques, collectively nicknamed Pass-ta-key, that exploit gaps in how Chrome and Google’s Cloud Authenticator handle device trust, onboarding, and recovery rather than breaking the underlying passkey cryptography itself.
The findings mark a blow to the passwordless authentication model that Google, Apple, and Microsoft have promoted as a phishing-resistant replacement for passwords.
New Passkey Attacks Let Malware Take Over Google Accounts
Passkeys use public-key cryptography and hardware-backed protections instead of shared secrets, eliminating entire categories of attacks like credential phishing and password reuse. The new research shows endpoint malware can still find a way around those protections.
Chrome stores synced passkey metadata in an unencrypted local database, giving unprivileged malware a roadmap of every service where a victim logs in with a passkey.
The core weakness lies in how Chrome manages its identity key, a hardware-backed credential meant to prove device possession to Google’s Cloud Authenticator.
Because that key is generated as a temporary, exportable blob instead of being locked inside the Trusted Platform Module, malware can extract it and sign authentication requests exactly as Chrome would, completing a login silently without any device unlock or biometric prompt.
A more advanced variant, Silver Pass-ta-key, defeats user verification entirely. By deleting or corrupting the local passkey state file, an attacker forces Chrome to re-onboard, during which the Cloud Authenticator accepts a newly registered, attacker-controlled verification key without verifying its origin.
That flaw grants the attacker permanent, reusable access from their own machine, even for accounts that require strict multi-factor authentication.
The most severe technique, Golden Pass-ta-key, targets the master encryption key protecting all of a victim’s synced passkeys, known as the security domain secret.
Arie Olshtein found this 32-byte secret briefly exposed in Chrome’s internal logs and still accessible in memory during device recovery.
Extracting it lets an attacker decrypt every passkey tied to an account, past and future, creating persistent access that survives detection, since Google currently has no mechanism to rotate that master key.
All three techniques require malware already running on a Windows machine with a Trusted Platform Module, specifically targeting Google Password Manager in Chrome, and Arie Olshtein found no evidence of in-the-wild exploitation or attribution to a known threat group.
Separately, the team found many relying parties fail to validate the “User Verified” flag returned during authentication, effectively reducing multi-factor authentication to a single factor. That gap was demonstrated against sites including eBay, which fixed the issue after disclosure.
Unit 42 is urging relying parties to enforce strict user-verification checks, require attestation for newly enrolled device keys, harden recovery flows against unexpected re-registration, and keep master key material out of client-side logs and memory.
Users can periodically review registered passkeys through Chrome’s settings to spot unfamiliar devices. The disclosure highlights that endpoint compromise remains central to the threat model even as passwords disappear.
Hardware-backed keys and cloud isolation raise the bar substantially, but they cannot eliminate risk when authentication still depends on signals from a device that may already be under an attacker’s control.
Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN.
