Loading story…
Google introduced an Android-mediated migration workflow that moves passwords and passkeys directly between compatible password-manager apps. Users start an import in their destination manager; Android identifies eligible installed source managers, then requires the user to review and authorize the transfer in the source app.
The feature eliminates the legacy practice of exporting credentials to downloadable, unencrypted CSV or text files and enables passkey migration, which was previously unavailable through typical export methods. Google Password Manager, 1Password, Bitwarden Password Manager, and Dashlane support the transfer flow, with additional partner support planned; Google has not detailed the Android versions supported or the technical protections used during inter-app credential transfer.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
Google announced an Android-mediated process that transfers passwords and passkeys directly between compatible password-manager applications, without requiring an unencrypted credential-export file. Google Password Manager, 1Password, Bitwarden Password Manager, and Dashlane support the initial rollout.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
6 references tracked. Mallory keeps watching after this page renders.
heise.de
Open sourceghacks.net
Open sourcearstechnica.com
Open sourcehelpnetsecurity.com
Open sourceblog.google
Open sourcedeveloper.android.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
NordPass, developed by Nord Security, provides a comprehensive password management solution with both free and premium tiers, supporting features such as autofill, password health monitoring, secure sharing, and emergency access. The service is accessible across all major platforms, including web, desktop, and mobile, and requires users to create a Nord Account for access. NordPass is highlighted for its user-friendly interface, robust security, and flexible subscription options for individuals, families, and businesses. Google Chrome's built-in password manager offers users the ability to save, manage, and autofill credentials directly within the browser, streamlining credential storage and reducing password fatigue. The Chrome password manager can be configured through browser settings, supports synchronization across devices, and provides enterprise controls for IT administrators to enforce access policies and monitor credential hygiene. Both solutions aim to enhance password security and convenience for users and organizations.
Jun 29, 2026
Microsoft has introduced a new Windows API that allows third-party applications, such as 1Password, to manage passkeys directly within Windows 11. This integration enables users to create, sync, and manage passkeys using their preferred password manager, leveraging Windows Hello for authentication. The update aims to simplify the user experience by allowing password managers to take over credential management from Windows, making it easier for users to adopt passkeys for secure authentication across devices and services. The shift towards passkey authentication is part of a broader industry move to replace traditional passwords with more secure, phishing-resistant credentials. Passkeys utilize cryptographic methods and can be managed by platform, virtual, or roaming authenticators, with password managers increasingly supporting software-only (virtual) authenticators. This approach addresses longstanding security issues associated with passwords, such as susceptibility to phishing and poor user password hygiene, and is expected to become the standard for online authentication as more services adopt passkey support.
Jul 12, 2026
Password managers have become essential tools for users managing a growing number of online accounts, but they are also increasingly targeted by cybercriminals. Attackers may attempt to compromise master passwords through brute-force attacks, exploit software vulnerabilities, or use phishing techniques such as malicious ads to trick users into revealing their credentials. Security experts highlight the importance of vigilance and adopting best practices to mitigate these risks, as unauthorized access to a password vault can lead to identity fraud or the sale of sensitive credentials on underground markets. In response to evolving authentication needs and security threats, Microsoft has introduced native support for third-party passkey managers in Windows 11, including 1Password and Bitwarden. This integration, enabled by a new passkey API, allows users to manage passkeys—secure authentication credentials based on FIDO2/WebAuthn standards—directly within Windows. Passkeys offer enhanced security by leveraging public-private key cryptography and are resistant to phishing attacks. The update also brings native integration of Microsoft Password Manager, providing users with more flexibility and security options for managing their digital identities.
Jul 12, 2026