Loading story…
Researchers and victim-support advocates warned that cyberstalkers are exploiting Google Chrome Sync as a covert surveillance method, allowing abusers to monitor a victim’s browsing activity without installing malware or obtaining the victim’s Google credentials. The technique requires only brief physical access to a phone or computer: an abuser signs Chrome into a Google account they control, enables sync, and can then remotely review browsing history and potentially other synced data. Certo Software said the method can expose visits to sensitive resources such as family lawyers or domestic violence support sites, making it particularly dangerous in coercive-control and domestic abuse cases.
The reported abuse affects Chrome across Android, iPhone, Windows, and Mac, and researchers said it is harder for victims to detect because Chrome does not provide prominent in-app warnings when a new account is added or sync is enabled. Certo said stronger mobile protections and app-store enforcement against stalkerware may be pushing abusers toward misuse of legitimate built-in features instead of traditional spyware. The company urged users to review which account is signed into Chrome, remove unknown accounts, and change important passwords if saved credentials may have been synced, while calling on Google to provide clearer and more persistent notifications around account changes and sync activation.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
CyberScoop reported on Certo's findings and described how abusers can sign Chrome into an attacker-controlled Google account and enable sync to spy on victims' browsing activity. The report highlighted a case example involving monitoring of visits to a family lawyer and domestic violence support website.
Certo Software reported that cyberstalkers are abusing Google Chrome's sync feature to monitor victims after brief physical access to a device, without installing traditional spyware. The technique can expose browsing history and potentially synced data such as saved passwords across mobile and desktop platforms.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
cyberscoop.com
Open sourcecertosoftware.com
Open sourcegs.statcounter.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that malware on a compromised Windows system can hijack **Google-synced passkeys** and take over accounts without the victim entering a password, PIN, or biometric factor. Unit 42 said the attack chain, dubbed **"Pass-ta-key,"** abuses weaknesses in Google Cloud Authenticator and Chrome’s handling of device trust, onboarding, and recovery rather than breaking passkey cryptography itself. The report said Chrome stores synced passkey metadata in a local unencrypted database and relies on an exportable identity key that malware can extract through standard Windows cryptography APIs. The researchers described multiple escalation paths, including forcing Chrome re-onboarding to register an attacker-controlled verification key and extracting the **security domain secret (SDS)** to decrypt all synced passkeys and maintain persistent access. The issue could enable broad account takeover across services that trust those passkeys, although some providers have already responded; **eBay** was cited as having patched verification weaknesses after disclosure. A separate report also highlighted that passkey security issues could lead to account takeover, underscoring wider concern over implementation and trust-model gaps in synced passkey ecosystems.
Aug 6, 2026
Researchers disclosed three attack paths—**Pass-ta-key**, **Silver Pass-ta-key**, and **Golden Pass-ta-key**—that let malware on a compromised Windows endpoint take over accounts protected by Google’s synced passkeys and Google Cloud Authenticator in Chrome. The attacks do not break passkey cryptography; instead, they abuse weaknesses in device trust, onboarding, recovery, and user-verification workflows. Unit 42 reported that even unprivileged malware can enumerate synced passkeys from Chrome’s local sync database, impersonate device identity to obtain valid authentication assertions without user interaction, and in some scenarios bypass or defeat user-verification protections. The researchers also described more severe escalation paths: an attacker can register an attacker-controlled user-verification key during re-onboarding, and in the highest-impact case, exposure of the **security domain secret** (`SDS`) through logs or memory can allow decryption of all synced passkeys. The findings further showed that some relying parties did not properly validate the WebAuthn **UV** flag, creating an MFA-bypass condition; **eBay** fixed such an issue after disclosure. The report recommends strict validation of WebAuthn user verification, attestation checks for device-key registration, stronger recovery and re-registration controls, better protection of local passkey data, and preventing client exposure of sensitive key material.
Aug 12, 2026
A serious unpatched **Chromium** vulnerability was accidentally exposed after Google engineers marked the issue as fixed without shipping a patch, causing the bug report and proof-of-concept to become public. The flaw, originally reported in 2022, abuses the **Background Fetch API** to keep a Service Worker and malicious JavaScript running after the browser is closed and, in some cases, even after a device reboot. Affected products include **Chrome**, **Microsoft Edge**, **Brave**, **Opera**, **Vivaldi**, and **Arc**. The bug could let attackers abuse victims’ browsers for proxying traffic, launching DDoS activity, opening websites, and tracking user behavior; Google later re-hid the report and said it is working on a fix. Separately, researchers analyzing the **VoidStealer** infostealer found it can bypass Chrome’s **Application-Bound Encryption (ABE)** on Windows by attaching to the browser as a debugger, intercepting the moment Chrome decrypts protected data, and extracting the master key from memory. That technique enables theft of cookies, sessions, and other sensitive browser data, and the risk extends to other Chromium-based browsers using the same protection model. Together, the disclosures show that Chromium ecosystems face both browser-level persistence abuse and post-compromise data theft, with defenders urged to watch for unusual download-menu behavior, keep browsers updated as fixes arrive, and harden endpoints against infostealer activity.
Jun 29, 2026