Pass-ta-key attacks let malware on a PC steal and export Google-synced passkeys

Palo Alto Networks Unit 42 described three techniques, collectively Pass-ta-key, in which malware already running on a compromised Windows PC abuses Google Password Manager's synced passkeys. None break the underlying cryptography; they target how Chrome stores device keys, re-enrolls a device, and whether a site verifies that a person was present. The techniques can silently obtain a valid login assertion without any unlock prompt, register an attacker-controlled verification key that defeats user-verification checks, or extract the secret that decrypts all of a user's synced passkeys for reuse elsewhere. Passkeys still resist phishing, but a fully compromised endpoint undermines the synced-passkey model.

Check

Recognize that endpoint compromise, not phishing, is the threat to synced passkeys, and confirm your important services actually require and validate the user-verification flag on passkey logins.

Affected

Users of Google Password Manager synced passkeys in Chrome on Windows whose device is infected; malware can forge logins, bypass user verification, and export all synced passkeys, even for strict accounts.

Fix

Prioritize endpoint security since these attacks need local malware, require and strictly validate user verification on sensitive accounts, and consider hardware-bound passkeys or security keys rather than synced ones for high-value access.