Cybersecurity researchers have uncovered a trio of sophisticated attacks that allow malware on compromised Windows devices to hijack Google-synced passkeys, bypassing user verification and stealing sensitive account information. Dubbed “Pass-ta-key” by Palo Alto Networks’ Unit 42, these novel exploits target Google Password Manager in Chrome on Windows machines equipped with Trusted Platform Modules (TPMs).
At the heart of this issue is the use of passkeys as a passwordless authentication method. Unlike traditional passwords, passkeys rely on cryptographic keys stored on a user’s device to sign in to online accounts. They offer enhanced security by being virtually impossible to guess or steal through phishing attacks, while also allowing users to authenticate with PINs or biometric data such as fingerprints or facial recognition.
However, the researchers have demonstrated that three distinct techniques can be employed by malware to abuse Google Password Manager’s synced passkeys. The first method, known as “Pass-ta-key,” enables unprivileged malware to impersonate a trusted device and request a valid authentication response for one of the victim’s passkeys. This is achieved by abusing Chrome’s TPM-backed device identity key to sign a request sent to Google’s cloud authenticator, which then treats the request as coming from the victim’s trusted computer.
The second technique, “Silver Pass-ta-key,” goes further by allowing attackers to register their own user-verification key with Google’s cloud authenticator. This is done by forcing Chrome to re-register the compromised device and registering a malicious user-verification key in its place. Once registered, the attacker can access accounts that require proper user verification without needing further access to the victim’s computer.
The third and most severe technique, “Golden Pass-ta-key,” allows malware to obtain the master key used to encrypt all passkeys synced through the victim’s Google Password Manager account. This is achieved by exploiting a weakness in how Chrome handles device trust and onboarding. Although Google has removed the secret from Chrome’s logging output following the researchers’ report, it remains temporarily accessible in the browser’s process memory.
The success of these attacks was demonstrated against eBay, which properly requires user verification but failed to validate whether that verification occurred. GitHub, on the other hand, successfully blocked the attack due to its proper validation of the User Verified flag. The issue has since been fixed by eBay after the researchers reported it.
This development highlights the importance of maintaining robust security measures and staying vigilant against emerging threats. For individuals using Google Password Manager with Chrome on Windows devices equipped with TPMs, it is essential to be aware of these potential vulnerabilities and take steps to mitigate them. This includes keeping software up-to-date, using strong and unique passkeys for each account, and monitoring activity closely for any signs of unauthorized access.
As cybersecurity threats continue to evolve, it is crucial that users stay informed about emerging risks and take proactive measures to protect themselves online. By doing so, individuals can minimize their exposure to sophisticated attacks like those demonstrated by the “Pass-ta-key” exploits.
Source: Bleeping Computer — 2026-08-03