Loading story…
Researchers reported that malware on a compromised Windows system can hijack Google-synced passkeys and take over accounts without the victim entering a password, PIN, or biometric factor. Unit 42 said the attack chain, dubbed "Pass-ta-key," abuses weaknesses in Google Cloud Authenticator and Chrome’s handling of device trust, onboarding, and recovery rather than breaking passkey cryptography itself. The report said Chrome stores synced passkey metadata in a local unencrypted database and relies on an exportable identity key that malware can extract through standard Windows cryptography APIs.
The researchers described multiple escalation paths, including forcing Chrome re-onboarding to register an attacker-controlled verification key and extracting the security domain secret (SDS) to decrypt all synced passkeys and maintain persistent access. The issue could enable broad account takeover across services that trust those passkeys, although some providers have already responded; eBay was cited as having patched verification weaknesses after disclosure. A separate report also highlighted that passkey security issues could lead to account takeover, underscoring wider concern over implementation and trust-model gaps in synced passkey ecosystems.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
After responsible disclosure, some affected sites including eBay patched verification weaknesses identified by the researchers. These fixes addressed relying-party validation gaps that could otherwise aid account takeover via the disclosed techniques.
Unit 42 reported that malware on a compromised Windows PC can hijack Google-synced passkeys and take over accounts without requiring the victim's password, PIN, or biometric prompt. The research described multiple attack paths exploiting weaknesses in Google Cloud Authenticator and Chrome's handling of device trust, onboarding, and recovery.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
csoonline.com
Open sourcecsoonline.com
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed three attack paths—**Pass-ta-key**, **Silver Pass-ta-key**, and **Golden Pass-ta-key**—that let malware on a compromised Windows endpoint take over accounts protected by Google’s synced passkeys and Google Cloud Authenticator in Chrome. The attacks do not break passkey cryptography; instead, they abuse weaknesses in device trust, onboarding, recovery, and user-verification workflows. Unit 42 reported that even unprivileged malware can enumerate synced passkeys from Chrome’s local sync database, impersonate device identity to obtain valid authentication assertions without user interaction, and in some scenarios bypass or defeat user-verification protections. The researchers also described more severe escalation paths: an attacker can register an attacker-controlled user-verification key during re-onboarding, and in the highest-impact case, exposure of the **security domain secret** (`SDS`) through logs or memory can allow decryption of all synced passkeys. The findings further showed that some relying parties did not properly validate the WebAuthn **UV** flag, creating an MFA-bypass condition; **eBay** fixed such an issue after disclosure. The report recommends strict validation of WebAuthn user verification, attestation checks for device-key registration, stronger recovery and re-registration controls, better protection of local passkey data, and preventing client exposure of sensitive key material.
Aug 12, 2026
Google has introduced new layered security defenses in Chrome to address the growing risks of indirect prompt injection attacks and account takeovers, particularly as the browser integrates more agentic AI capabilities. Key features include the User Alignment Critic, which independently evaluates and vetoes potentially malicious actions by Chrome's AI agent, and Agent Origin Sets, which restrict the agent's data access to only relevant or user-approved sources. These measures are designed to prevent attackers from exploiting untrusted web content to hijack user sessions or exfiltrate sensitive data, and to mitigate site isolation bypasses that could compromise user privacy and security. In parallel, Google has acknowledged a surge in account takeover incidents targeting Chrome users, where attackers steal credentials, authentication codes, and session cookies to access synchronized data stored in the cloud. The company is urging users to strengthen their authentication methods and reconsider the use of browser-based password managers, as a single compromised account can expose a wide range of personal information. Google is also rolling out additional protections for Workspace accounts to counteract these threats and safeguard user data across its ecosystem.
Jun 29, 2026
SpecterOps disclosed a **"Pass-the-Passkey"** attack family that can undermine passkey-based authentication in **Windows 11** and **Microsoft Entra ID** without extracting private keys from hardware tokens or trusted enclaves. The most serious chain used Windows 11 event logging that recorded full WebAuthn assertion responses and paired it with Entra ID replay-validation weaknesses, allowing attackers to replay harvested assertions and gain access to privileged cloud accounts while still meeting phishing-resistant MFA checks. Microsoft addressed the Windows logging exposure as **`CVE-2026-34348`**, truncating logged signature fields to six bytes. The research also described local attack paths that abuse legitimate WebAuthn APIs for prompt flooding, application identity spoofing, remote desktop pass-through, and Credential UI spoofing, enabling local passkey phishing and user-fatigue scenarios. Researchers released open-source tooling to help defenders test for assertion injection, event-log mining, and WebAuthn API hooking, and recommended patching Windows 11, enforcing server-side anti-replay protections, monitoring WebAuthn API activity, and requiring hardware-backed attestation for high-privilege Entra ID accounts.
Aug 10, 2026