New research reveals that malware already sitting on a compromised Windows PC can hijack Google’s synced passkeys and take over accounts without ever prompting the victim for a password, PIN, or fingerprint.
The findings, detailed in the third part of a series examining passkey security, expose flaws in how Google’s Cloud Authenticator handles device trust, onboarding, and recovery, undermining the very protections passkeys were designed to provide.
Passkeys were built to replace passwords with public-key cryptography, eliminating the shared secrets that phishing and credential-stuffing attacks rely on.
Unit 42 researchers found that Chrome stores synced passkey metadata locally in an unencrypted, easily readable database, giving malware a roadmap of every service where a victim uses passkey login, without needing elevated privileges.
The core issue lies in how Chrome manages its “identity key,” a hardware-backed credential meant to prove device possession to Google’s Cloud Authenticator.
Because this key is generated as a temporary, exportable blob rather than being permanently locked inside the Trusted Platform Module (TPM), malware can extract it and use standard Windows cryptography APIs to sign authentication requests exactly as Chrome would.
This lets an attacker complete a full passkey login, dubbed the “Pass-ta-key” attack, silently and without triggering any device unlock or biometric prompt.
Bypassing Multi-Factor Protections
A more advanced variant, the “Silver Pass-ta-key” attack, goes further by defeating user verification altogether. By deleting or corrupting the local passkey state file, attackers can force Chrome into a re-onboarding process.
During this window, the Cloud Authenticator accepts a newly registered, attacker-controlled verification key without validating its origin, effectively handing the attacker a permanent, reusable way to authenticate as the victim from their own machine, even for accounts requiring strict multi-factor authentication.
The most severe technique, the “Golden Pass-ta-key” attack, targets the master encryption key protecting all of a user’s synced passkeys, known as the security domain secret (SDS).
Researchers discovered this 32-byte secret was briefly exposed in Chrome’s internal logs and remains accessible in memory during device recovery. Extracting it lets an attacker decrypt every passkey tied to an account, past and future, creating persistent access that survives even after the compromise is detected, since Google currently offers no way to rotate this master key.
The researchers emphasize that this doesn’t break passkey cryptography itself; it exploits gaps between design assumptions and real-world implementation, particularly the trust placed in client devices and inconsistent validation by relying parties. Some affected sites, including eBay, have already patched the verification gaps after responsible disclosure.
For defenders, recommended mitigations include strictly enforcing user-verification checks, validating device key attestation before registration, restricting local access to browser credential stores, and monitoring for unexpected re-triggering of onboarding or recovery flows.
Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.
