Google Synced Passkeys Can Be Hijacked By Malware In New Attack

by Aaron Leong — Tuesday, August 04, 2026, 11:50 AM EDT

Cybersecurity researchers at Palo Alto Networks' Unit 42 have uncovered three novel post-compromise attack vectors that allow local malware on Windows PCs to quietly hijack Google-synced passkeys, bypassing biometric checks and PIN prompts.

Dubbed Pass-TA-Key, Silver Pass-TA-Key, and Golden Pass-TA-Key, the techniques target the Google Password Manager in Chrome on Windows machines equipped with a Trusted Platform Module (TPM). Now, passkeys are widely considered the current gold standard for passwordless security because they rely on public-key cryptography to prevent phishing and credential theft. However, these attacks do not crack the cryptographic mathematics. Instead, they exploit how Chrome manages device trust, stores credential metadata, and handles cloud re-enrollment.

The exploitation process starts on an infected endpoint. Chrome saves synchronized credential metadata inside an unencrypted local LevelDB database, giving unprivileged malware a clean index of every service where the victim uses passkey authentication.

In the basic Pass-TA-Key attack, malware extracts Chrome's TPM-backed identity key and uses standard Windows Cryptography APIs to sign an authentication request to Google’s Cloud Authenticator. Google returns a valid login assertion without prompting the user or asking for fingerprints or PINs. While this assertion leaves the "User Verified" flag set to false, thus causing strict sites like GitHub to reject the attempt, Unit 42 confirmed that other platforms, such as eBay, initially accepted the login without validating the flag. eBay has since patched the flaw following responsible disclosure.

github fail1 — *Credit: Palo Alto Network's Unit 42*

To bypass strict user verification altogether, attackers escalate to Silver Pass-TA-Key. Malware intentionally corrupts or deletes Chrome's local passkey state, triggering a forced device re-enrollment. Because Google’s Cloud Authenticator does not check whether a newly registered user-verification key originates from secure hardware, the attacker can register their own key during the setup process. Future login requests signed with the attacker's key carry a legitimate "User Verified" bit, enabling permanent remote logins from the attacker's own hardware without further touching the victim's device.

The most advanced attack, Golden Pass-TA-Key, steals the 32-byte master encryption key known as the Security Domain Secret (SDS). This master secret is temporarily sent to Chrome during device onboarding or account recovery to decrypt synced passkeys. Researchers demonstrated that by forcing a re-registration, malware can extract the master secret directly from Chrome's process memory. Armed with the SDS, an attacker can decrypt every synced passkey private key in the account, clone them externally, and maintain access indefinitely. Because Google Password Manager currently lacks an SDS rotation or revocation mechanism, a stolen master secret continues to compromise both past and future passkeys synced to the account.

While Google fixed an initial exposure where the SDS was written to internal FIDO logs, Unit 42 notes that the secret still passes through client process memory.