Loading story…
Attackers can abuse Google’s Family Link parental controls to lock legitimate owners out of compromised personal Google accounts. ReversingLabs reproduced the lockout by changing an account’s age and supervision relationship, leaving sign-in or recovery dependent on approval from an unknown parent account. Reports of similar incidents prompted recovery guidance, but the investigation did not establish which malware, if any, caused those reported compromises.
Affected users should attempt Google’s official account recovery from a trusted device, preserve evidence of unauthorized supervision, and report the issue through Google For Families support; recovery is not guaranteed. Suspected endpoint compromise requires separate remediation: removing malware or reinstalling Windows does not remove cloud-account supervision or revoke every stolen session. After recovering access, users should confirm that unauthorized supervision has been removed and review account security settings, Gmail configuration, and other affected services.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
ReversingLabs reproduced a Google account lockout by using access to the account’s settings and password to change its age and supervision relationship, causing recovery to require parent approval. Researchers could not retrieve the original suspicious game executable and did not establish which malware caused similar reported incidents.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that malware on a compromised Windows system can hijack **Google-synced passkeys** and take over accounts without the victim entering a password, PIN, or biometric factor. Unit 42 said the attack chain, dubbed **"Pass-ta-key,"** abuses weaknesses in Google Cloud Authenticator and Chrome’s handling of device trust, onboarding, and recovery rather than breaking passkey cryptography itself. The report said Chrome stores synced passkey metadata in a local unencrypted database and relies on an exportable identity key that malware can extract through standard Windows cryptography APIs. The researchers described multiple escalation paths, including forcing Chrome re-onboarding to register an attacker-controlled verification key and extracting the **security domain secret (SDS)** to decrypt all synced passkeys and maintain persistent access. The issue could enable broad account takeover across services that trust those passkeys, although some providers have already responded; **eBay** was cited as having patched verification weaknesses after disclosure. A separate report also highlighted that passkey security issues could lead to account takeover, underscoring wider concern over implementation and trust-model gaps in synced passkey ecosystems.
Aug 6, 2026
Google has launched a new security feature for Gmail and Google accounts that allows users to designate trusted friends or family members as recovery contacts. This feature is designed to help users regain access to their accounts if they are locked out, for example, due to forgotten passwords, lost passkey devices, or account compromise. Users can select up to 10 trusted contacts, who must accept the request to serve in this role. When a user is locked out, they can initiate the recovery process, which involves sharing a code with their chosen contact. The contact receives a notification and must verify the request by selecting the correct code from a set of options, ensuring that only genuine requests are honored. This process uses number-matching authentication to reduce the risk of social engineering attacks. Google recommends that users choose contacts who are likely to respond quickly, as the recovery request expires after 15 minutes. The company also advises selecting individuals with strong cybersecurity awareness to minimize the risk of exploitation by attackers. The trusted contacts feature is part of Google’s broader push towards passkeys as the future of account authentication, addressing the challenge of device loss that can leave users unable to access their accounts. The recovery process is designed to be secure, with the contact unable to access the user’s account directly, but able to verify the user’s identity. Google Messages will also alert users to spam and help keep texts private, further enhancing account security. The setup process for recovery contacts is straightforward and can be completed on both desktop and mobile devices via the Google account security settings. This new method provides an additional layer of resilience for account recovery, supplementing existing options like email and SMS. The feature aims to reduce the frustration and risk associated with being locked out of critical accounts, especially as more users transition to passwordless authentication. Google’s approach balances convenience with security, leveraging personal trust relationships while maintaining technical safeguards. The company acknowledges that, while unlikely, sophisticated attackers could attempt to exploit the process, so user vigilance remains important. Overall, the trusted contacts feature represents a significant enhancement to Google’s account recovery options, providing users with more reliable and secure ways to regain access to their accounts.
Jun 29, 2026
Researchers disclosed three attack paths—**Pass-ta-key**, **Silver Pass-ta-key**, and **Golden Pass-ta-key**—that let malware on a compromised Windows endpoint take over accounts protected by Google’s synced passkeys and Google Cloud Authenticator in Chrome. The attacks do not break passkey cryptography; instead, they abuse weaknesses in device trust, onboarding, recovery, and user-verification workflows. Unit 42 reported that even unprivileged malware can enumerate synced passkeys from Chrome’s local sync database, impersonate device identity to obtain valid authentication assertions without user interaction, and in some scenarios bypass or defeat user-verification protections. The researchers also described more severe escalation paths: an attacker can register an attacker-controlled user-verification key during re-onboarding, and in the highest-impact case, exposure of the **security domain secret** (`SDS`) through logs or memory can allow decryption of all synced passkeys. The findings further showed that some relying parties did not properly validate the WebAuthn **UV** flag, creating an MFA-bypass condition; **eBay** fixed such an issue after disclosure. The report recommends strict validation of WebAuthn user verification, attestation checks for device-key registration, stronger recovery and re-registration controls, better protection of local passkey data, and preventing client exposure of sensitive key material.
Aug 12, 2026