One captured 6-digit PIN is now all it takes for a phishing attacker to walk away with a victim’s entire Google Password Manager (GPM) vault.
Dubbed “Vaultjacking” by researchers at PhishU, this newly documented Adversary-in-the-Middle (AiTM) technique bypasses per-site passkey protections by targeting the underlying synchronization layer.
By stealing a user’s GPM PIN during a routine login, threat actors can decrypt and clone every saved password and passkey and transfer them to their own infrastructure.
The blast radius is total, compromising banking systems, source code repositories, and workplace single sign-on environments in a single strike.
VaultJacking Exposes Google Vault
This research extends a thread Curtis Brazzell, PhishU’s CEO, has been tracking since 2020 regarding trust-boundary problems in credential managers.
Vaultjacking exploits Google’s structural design choice to rely on a short PIN rather than cross-device push approvals for lost-device recovery.
Passkeys effectively bind credentials to a site’s origin. However, Vaultjacking sidesteps this by targeting the cloud-side decision about which devices get to read the synchronized vault.
The exploitation chain begins with a standard AiTM phishing page that captures session cookies, followed by a perfectly styled modal that asks for the user’s GPM PIN.
Once captured, an automated background worker silently adds an operator-owned passkey to the victim’s Google account.
This establishes long-term persistence that survives password resets, cookie expiration, and even Google’s upcoming enforcement of Device Bound Session Credentials (DBSC).
Using a containerized Windows VM equipped with a virtualized Trusted Platform Module (TPM), the attacker authenticates using the persistent passkey and joins the victim’s security domain.
Chrome’s enclave manager accepts the virtual TPM as a valid hardware identity. When prompted, the automated worker enters the captured 6-digit PIN.
This single verification releases the Security Domain Secret (SDS), allowing the attacker to decrypt the entire synced credential vault locally without triggering push notifications on the victim’s actual mobile devices, PhishU said.
| Attack Phase | Technical Mechanism | Primary Detection Signal |
|---|---|---|
| Initial Access | AiTM proxy captures session cookies and GPM PIN via fake modal | Suppressed by attacker |
| Persistence | Registers operator-owned passkey to victim’s Google account | “New passkey added” email |
| Vault Extraction | VM joins security domain to unlock Security Domain Secret | “New sign-in” email |
Because this technique exploits intended sync-layer behaviors rather than a cryptographic flaw, it cannot be fixed by simply changing the WebAuthn handshake.
Defenders must focus on policy enforcement and structural network monitoring to counter the threat. The attack does not require a foothold on the victim’s local device.
It successfully replays both software- and hardware-backed passkeys via Google’s server-side enclave.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
 vault.){kind=link}