New Attack Methods Enable Malware to Hijack Passkey-Protected Accounts
Palo Alto Networks researchers disclosed "Pass-ta-key," a new class of attacks targeting Google-synced passkeys that enable account takeover without privilege escalation or user interaction Three attack variants were identified: basic Pass-ta-key extracts device identity keys from Chrome's local storage to forge authentication signatures, Silver Pass-ta-key forces device re-registration to inject attacker-controlled verification keys, and Golden Pass-ta-key extracts a master secret from Chrome's
Analysis
TL;DR
- Palo Alto Networks researchers disclosed "Pass-ta-key," a new class of attacks targeting Google-synced passkeys that enable account takeover without privilege escalation or user interaction
- Three attack variants were identified: basic Pass-ta-key extracts device identity keys from Chrome's local storage to forge authentication signatures, Silver Pass-ta-key forces device re-registration to inject attacker-controlled verification keys, and Golden Pass-ta-key extracts a master secret from Chrome's memory to decrypt all synchronized passkey private keys
- The attacks exploit the trust model between Chrome's local synchronization database and Google's cloud authenticator service, bypassing biometric prompts and device unlock requirements
- Google has been notified and has reportedly rolled out some mitigations, though the full scope of the vulnerability landscape remains to be seen
Why It Matters
This research fundamentally challenges the assumption that passkeys are immune to malware-based account takeover, exposing a critical gap between the theoretical security guarantees of WebAuthn and real-world deployment on compromised devices. For AI practitioners and security professionals, it highlights how authentication infrastructure that relies on cloud-device trust relationships can be subverted when the local device is already compromised, a scenario increasingly relevant as AI-driven malware becomes more sophisticated.
Technical Details
- Pass-ta-key (basic variant): Malware on a Windows machine running Chrome examines the browser's local sync database to enumerate passkey-protected accounts, usernames, and encrypted credential material. It recovers a device identity key stored on disk or in memory, then uses Windows cryptographic APIs to sign challenges from Google's cloud authenticator service without triggering biometric prompts or requiring elevated privileges.
- Silver Pass-ta-key (advanced variant): The malware forces Chrome into a device re-registration flow, exploiting a timing window to register the attacker's own user-verification key with Google's cloud authenticator. This enables authentication from a completely different machine at a later time, effectively establishing persistent remote access.
- Golden Pass-ta-key (most severe variant): During the re-enrollment process, a master secret briefly appears in Chrome's process memory, which the malware extracts. Possession of this secret allows decryption of every synchronized passkey private key for the account, including future passkeys, representing a complete and lasting compromise of the passkey-based authentication chain.
- The attacks specifically target Google-synced passkeys and exploit the architectural trust between Chrome's local sync database and Google's cloud authenticator service, bypassing core WebAuthn security properties like user presence verification.
Industry Insight
- Organizations and developers relying on passkeys as a phishing-resistant authentication method must reassume zero-trust principles for device-level security; passkeys alone cannot protect accounts on compromised endpoints, and defense-in-depth strategies including endpoint detection and response are essential complements.
- The existence of a master key extraction technique (Golden Pass-ta-key) that enables decryption of future passkeys suggests that key rotation and periodic re-enrollment should be treated as critical incident response procedures, and platform vendors should prioritize shortening the exposure window during synchronization and re-enrollment operations.
- As AI-powered malware becomes more capable of memory scraping and process manipulation, the attack surface described here will likely expand to other passkey implementations beyond Chrome and Google, making cross-platform security audits and standardized device attestation mechanisms a pressing industry priority.
Disclaimer: The above content is generated by AI and is for reference only.