Novel Malware Attacks Hijack Google-Synced Passkeys on Chrome

Researchers disclosed three attack paths—Pass-ta-key, Silver Pass-ta-key, and Golden Pass-ta-key—that let malware on a compromised Windows endpoint take over accounts protected by Google’s synced passkeys and Google Cloud Authenticator in Chrome. The attacks do not break passkey cryptography; instead, they abuse weaknesses in device trust, onboarding, recovery, and user-verification workflows. Unit 42 reported that even unprivileged malware can enumerate synced passkeys from Chrome’s local sync database, impersonate device identity to obtain valid authentication assertions without user interaction, and in some scenarios bypass or defeat user-verification protections.

The researchers also described more severe escalation paths: an attacker can register an attacker-controlled user-verification key during re-onboarding, and in the highest-impact case, exposure of the security domain secret (SDS) through logs or memory can allow decryption of all synced passkeys. The findings further showed that some relying parties did not properly validate the WebAuthn UV flag, creating an MFA-bypass condition; eBay fixed such an issue after disclosure. The report recommends strict validation of WebAuthn user verification, attestation checks for device-key registration, stronger recovery and re-registration controls, better protection of local passkey data, and preventing client exposure of sensitive key material.