Security researchers have uncovered three new attacks that could let malware hijack Google-synced passkeys and take over online accounts from compromised Windows devices.
The techniques target Google Password Manager in Chrome and abuse weaknesses in device trust, user verification, re-registration, credential recovery, and passkey synchronization.
Depending on the technique, attackers could bypass verification, authenticate from another system, or recover the private keys protecting synced credentials.
Unit 42 did not report observing exploitation in the wild, and the available research does not identify affected Chrome versions or confirm whether every attack path has been fully addressed.
Three attacks target passkey security controls
Palo Alto Networks Unit 42 named the techniques Pass-ta-key, Silver Pass-ta-key, and Golden Pass-ta-key. Each targets a different part of Google Password Manager’s passwordless authentication system, including device identity, user verification, recovery, and credential synchronization.
The basic Pass-ta-key technique allows unprivileged malware to use Chrome’s TPM-backed device identity key to request a valid authentication assertion from Google’s cloud authenticator. The request can occur without administrator privileges, biometrics, a PIN, or visible user interaction.
The technique can fail when a website requires user verification and correctly checks the User Verified flag. Unit 42 successfully tested the attack against eBay because the service did not properly validate the flag, BleepingComputer reported. eBay corrected the issue after the researchers disclosed it.
Silver Pass-ta-key targets device re-registration. Malware can force Chrome to enroll the device again and register an attacker-controlled verification key because Google’s cloud authenticator does not confirm that the new key came from trusted hardware.
Google may then accept signatures from the attacker’s key as proof that the victim completed PIN or biometric verification. The attacker could subsequently authenticate from another system without maintaining access to the original computer.
Golden Pass-ta-key exposes encryption keys
The most severe technique targets the Security Domain Secret used to encrypt passkeys synchronized through Google Password Manager.
Unit 42 initially found the secret exposed in Chrome’s internal FIDO logs. Google removed it from the logs following disclosure, but the researchers said the secret is still sent to Chrome and remains temporarily accessible in the browser’s process memory.
Malware could force device re-registration, locate the secret in memory, and use it to decrypt the victim’s synchronized passkey records. The Hacker News reported that attackers could then extract private keys, transfer them to another system, and impersonate the victim.
Unit 42 also warned that the same secret protects both existing and future synced passkeys. Google’s implementation reportedly does not provide a way to rotate or revoke the secret, potentially leaving future credentials exposed after a compromise.
What security teams should do
Organizations should treat Pass-ta-key as a post-compromise threat. Every described technique requires malware to already be running on the Windows endpoint, making endpoint protection, malware detection, and incident response the first lines of defense.
Websites supporting passkeys should require user verification and correctly validate the User Verified flag in every authentication response. Credential providers should also verify newly registered device keys, strengthen re-enrollment and recovery processes, and prevent encryption secrets from becoming accessible in browser memory.
Security teams should investigate unexpected Google Password Manager recovery prompts, unexplained device re-registration, and passkey logins from unfamiliar systems.
Passkeys remain more resistant to phishing and credential reuse than passwords. The research shows, however, that passwordless authentication still depends on the security of the endpoint, browser, cloud authenticator, and synchronization process surrounding the credential.
Looking for a safer way to manage credentials across your organization? See which six enterprise password managers stand out in 2026.