Passkeys have been pushed as the safer successor to passwords. It promised protection from phishing, credential reuse, and password leaks. Google even claims that it cannot be copied or accidentally handed to someone else. But it might not be as secure as the company wants it to be.
Security researchers (Via BleepingComputer) have now found three ways malware can undermine those promises for passkeys synced through Google Password Manager. The techniques, collectively named Pass-ta-key, target Google Password Manager inside Chrome on Windows computers equipped with a Trusted Platform Module. Every attack requires malware to already be running on the victim’s computer.
The researchers did not break the cryptography behind passkeys. They exploited weaknesses in device trust, account recovery, onboarding, and how services verify that the user actually unlocked their device.
Malware can impersonate your trusted computer
The first Pass-ta-key technique lets malware use Chrome’s TPM-backed device identity to request a valid passkey response from Google’s cloud authenticator. It requires no administrator privileges, biometric scan, PIN, device unlock, or interaction from the victim. Google’s service sees the request as coming from a trusted computer and returns the authentication response needed to sign in.
Websites are supposed to check a flag confirming that the user verified their identity. Unit 42 found that GitHub correctly rejected the attack, while eBay accepted it despite supposedly requiring verification. eBay fixed that gap after the researchers reported it.
The more advanced Silver Pass-ta-key attack can force Chrome to register a verification key controlled by the attacker. That key is then treated as proof that the victim entered a PIN or used biometrics, allowing account access from another computer after the original device goes offline.
The worst attack steals the keys themselves
The Golden Pass-ta-key technique targets the master secret used to encrypt every passkey synced through a Google account. Researchers initially found that Chrome exposed this secret in plain text through its internal FIDO logs. Google removed it from the logs following disclosure. However, Unit 42 says the key still temporarily appears inside Chrome’s process memory during device registration or recovery. Malware can extract it and decrypt the victim’s synced passkeys.
The stolen master key could reportedly expose existing and future passkeys. Unit 42 adds that Google’s current implementation provides no method to rotate or revoke that secret after it has been compromised. Passkeys remain substantially safer against phishing and password leaks. Google’s documentation still accurately describes those advantages. This research shows that malware already inside your computer can attack the infrastructure surrounding the passkey instead.