Cybersecurity researchers have disclosed three new attack techniques targeting passkeys synced through Google Password Manager, warning that attackers with malware already running on compromised Windows computers could potentially gain unauthorized access to users’ online accounts. Researchers from Palo Alto Networks’ Unit 42 have collectively named the attacks “Pass-ta-key.” They emphasized that the techniques do not break the cryptographic security of passkeys but instead exploit weaknesses in the trust, recovery and synchronization mechanisms between Google Password Manager, the Chrome browser and Google’s cloud authenticator.
Passkeys are widely regarded as a more secure alternative to traditional passwords because they rely on cryptographic key pairs rather than reusable credentials. Unlike passwords, they cannot be easily guessed, reused or stolen through phishing attacks, and users typically authenticate using a PIN, fingerprint or facial recognition. However, the researchers noted that if a Windows device is already infected with malware, these protections can, under certain conditions, be bypassed.
The first technique, known as Pass-ta-key, allows malware running without administrator privileges to impersonate the victim’s trusted device. The attack abuses Chrome’s Trusted Platform Module (TPM)-backed device identity mechanism to send authentication requests to Google’s cloud authenticator as though they originated from the legitimate user’s computer. The process requires no user interaction, biometric authentication or device unlocking. However, the attack fails against websites that properly verify the User Verified flag. During testing, researchers found that the technique failed against GitHub, which correctly validated user verification, but initially succeeded against eBay because the platform did not properly check the verification flag. eBay has since addressed the issue following responsible disclosure.
The second technique, called Silver Pass-ta-key, is considered more dangerous. It enables attackers to force Chrome on a compromised device to undergo a re-registration process and register a User Verification Key controlled by the attacker. Once the malicious key is accepted by Google’s cloud authenticator, the attacker may subsequently authenticate from another system without requiring further access to the victim’s device, even when websites correctly enforce user verification.
The third and most serious technique, Golden Pass-ta-key, targets the Security Domain Secret (SDS)—the master key used to encrypt all passkeys synchronized through Google Password Manager. According to Unit 42, this secret was previously exposed in Chrome’s internal FIDO logs in plaintext. Although Google removed it from the logs after being notified, the researchers stated that the SDS is still temporarily available in Chrome’s process memory during device registration or account recovery, where sophisticated malware could potentially extract it.
If an attacker succeeds in obtaining the SDS, they could decrypt the victim’s synced passkeys, recover their private keys and transfer them to another system to impersonate the user when signing into online accounts. The researchers further warned that Google’s current implementation reportedly does not provide an effective mechanism to rotate or revoke the master key, meaning both existing and future synced passkeys remain protected by the same secret.
The findings have been responsibly disclosed to Google, while user verification issues identified during testing were also reported to affected online services, including eBay. At the time of publication, Google had not publicly confirmed whether all of the identified issues had been fully addressed.
Renowned cybercrime expert and former IPS officer Prof. Triveni Singh said the research serves as an important reminder that although passkeys are significantly more secure than conventional passwords, they cannot eliminate risks posed by malware already present on compromised devices. He advised users to keep their operating systems and browsers fully updated, install software only from trusted sources, deploy robust endpoint security solutions and continuously monitor systems for suspicious activity. He also recommended that website operators enforce strict User Verification checks, strengthen device re-registration workflows and implement additional safeguards within cloud authentication systems to minimize the risk posed by such advanced attack techniques.
