Cybersecurity Researchers Uncover Novel Pass-ta-key Attacks on Google-synced Passkeys
A trio of sophisticated attacks has been discovered that enable malware on compromised Windows devices to hijack passkeys stored in Google Password Manager. These “Pass-ta-key” attacks allow malicious software to bypass user verification and extract private keys, putting millions of users at risk.
The targeted passkeys are a passwordless authentication method used by Google, which stores cryptographic keys on the user’s device. Unlike traditional passwords, passkeys cannot be guessed or easily stolen through phishing, making them a more secure option for online accounts. However, this novel set of attacks exploits weaknesses in how Chrome and Google’s cloud authenticator handle device trust, onboarding, recovery, and synced credentials.
The first technique, dubbed “Pass-ta-key”, allows malware to impersonate a trusted device and request an authentication response from the cloud authenticator. By abusing Chrome’s Trusted Platform Module (TPM) identity key, the malware can sign a request without administrator privileges, user interaction, or biometric verification. If the targeted service does not properly validate the User Verified flag, which indicates whether biometric or PIN verification occurred, the attack may succeed.
One of the most concerning aspects of this technique is that it was successfully tested against eBay’s systems, despite requiring user verification. However, after researchers reported the issue, the company promptly fixed the problem, ensuring its users’ accounts are now protected from this type of attack.
The second technique, “Silver Pass-ta-key”, goes further by allowing attackers to register their own user-verification key with Google’s cloud authenticator. By forcing Chrome to re-register using malware on the compromised device, the attacker can register a new verification key that they control. This allows them to access accounts that require and validate user verification without needing further access to the victim’s computer.
The third and most severe technique, “Golden Pass-ta-key”, enables malware to obtain the master key used to encrypt all passkeys synced through the victim’s Google Password Manager account. Although Google removed this secret from Chrome’s logging output after being reported, it is still sent to the client and remains temporarily accessible in Chrome’s process memory.
These attacks serve as a stark reminder that even with more secure authentication methods like passkeys, vulnerabilities can still exist. To protect yourself, make sure your antivirus software is up-to-date and consider using a password manager that does not rely on cloud syncing. Additionally, always monitor your accounts for suspicious activity and report any issues to the affected service providers. By staying vigilant and taking proactive measures, you can minimize the risk of falling victim to these sophisticated attacks.
Source: Bleeping Computer — 2026-08-03