Malware Can Now Hijack Google-Synced Passkeys Without Ever Touching a Password

Passkeys were sold to security teams as the fix for phishing. Unit 42 research shows that promise breaks down the moment malware is already sitting on the device, and Google’s synced-passkey ecosystem gives that malware three separate ways in.

What Happened

Palo Alto Networks’ Unit 42 disclosed three techniques, Pass-ta-key, Silver Pass-ta-key, and Golden Pass-ta-key, that let malware already running on Windows hijack accounts protected by passkeys synced through Google Password Manager. The base attack extracts Chrome’s wrapped device identity key to impersonate the device without an unlock. Silver Pass-ta-key forces re-onboarding and registers an attacker-controlled verification key for fully remote access. Golden Pass-ta-key is the most severe: it dumps Chrome’s process memory during re-registration to steal the Security Domain Secret, the master key that decrypts every passkey the victim has ever synced.

Why It Matters

None of the three techniques breaks passkey cryptography. Unit 42 says the weaknesses sit in device trust, account recovery, and verification checks, not the FIDO2 protocol. Passkeys still defeat remote phishing, but they were never built to survive an already-compromised endpoint, and Google currently has no way to rotate or revoke the Security Domain Secret once it is exposed. Google removed the secret from Chrome’s logging output after the report, a partial fix that leaves the memory-access route open.

The Original Insight

Passkey adoption has been pitched internally as a way to shrink the identity attack surface, when in practice it moves the highest-value target from a password database to endpoint memory, with no revocation option if that memory gets read. CyberTech has previously covered vishing crews abusing passkey enrollment as an MFA bypass, and Pass-ta-key extends that lesson to the device side. Until Google can rotate the Security Domain Secret, treat any confirmed malware infection on a device with synced Google passkeys as a probable credential-theft event, not just an endpoint incident, and prioritize attestation checks on new key registrations over trusting a passkey prompt alone.

Source: Unit 42