Malware Exploits Google Passkey Sync Flaws to Steal Credentials
Researchers have discovered the 'Pass-ta-key' attack, enabling malware on Windows PCs to steal Google synced passkeys without requiring user passwords, PINs, or fingerprints.
A significant security vulnerability has been uncovered that allows malware to steal Google's synced passkeys from compromised Windows PCs, bypassing the very security measures designed to protect them. Researchers from Unit 42 detailed the "Pass-ta-key" attack, which exploits how Google Chrome stores passkey metadata locally and manages its "identity key." This attack chain enables threat actors to gain unauthorized access to user accounts without triggering any password, PIN, or biometric authentication prompts.
Passkeys were introduced as a more secure alternative to traditional passwords, leveraging public-key cryptography to eliminate shared secrets vulnerable to phishing and credential-stuffing. However, the "Pass-ta-key" attack highlights a critical flaw: Chrome stores synced passkey metadata in an unencrypted, easily accessible local database. This provides malware with a comprehensive list of services where a user has enabled passkey logins, all without requiring elevated system privileges.
The core of the exploit lies in the handling of Chrome's "identity key." This key, intended to prove device possession to Google's Cloud Authenticator, is generated as a temporary, exportable blob. Crucially, it is not permanently secured within the device's Trusted Platform Module (TPM). Malware can therefore extract this identity key and utilize standard Windows cryptography APIs to sign authentication requests, mimicking Chrome's legitimate behavior and silently completing the passkey login process.
More sophisticated variants of the attack further undermine security. The "Silver Pass-ta-key" attack can defeat user verification entirely. By corrupting or deleting the local passkey state file, attackers can force Chrome into a re-onboarding process. During this phase, the Cloud Authenticator may accept a newly registered verification key from the attacker without proper origin validation, granting persistent authentication capabilities even for accounts with multi-factor authentication enabled.
The most severe threat is the "Golden Pass-ta-key" attack, which targets the security domain secret (SDS). This master encryption key protects all of a user's synced passkeys. Researchers found that the SDS is briefly exposed in Chrome's internal logs and can be accessed in memory during device recovery processes. Extracting this key allows an attacker to decrypt all past and future passkeys associated with an account, providing persistent access that cannot be revoked by Google, as there is currently no mechanism to rotate this master key.
While the underlying passkey cryptography remains secure, these attacks exploit implementation gaps and assumptions about client device security. The researchers noted that some affected websites, such as eBay, have already implemented patches following responsible disclosure. Recommended mitigations for defenders include enforcing strict user-verification checks, validating device key attestation during registration, securing local browser credential stores, and monitoring for unusual onboarding or recovery flows.
This discovery underscores the need for continuous vigilance in securing authentication mechanisms, even those designed to be more robust than passwords. As passkeys gain wider adoption, addressing these client-side vulnerabilities will be crucial to maintaining user trust and account security across the digital ecosystem.