Passkeys are designed to reduce reliance on passwords and to make phishing dramatically harder. Yet new research shows that “passwordless” does not automatically mean “attack-proof.” In fact, attackers are finding ways to perform passkey hijacking by abusing how a browser synchronizes credentials and how it authenticates with a cloud service.
Palo Alto Networks researchers disclosed multiple attack methods that focus on passkeys synced through Google’s ecosystem. The core theme is simple: if malware already runs on a user’s Windows machine with a Chromium-based browser, it may be able to obtain enough trust signals to complete logins—sometimes without any prompt to the user and without needing privilege escalation.
Why passkeys are still a security leap
Passkeys have gained momentum because they are engineered to block common phishing workflows. Instead of tricking users into entering credentials on a fake site, the authentication process depends on cryptographic operations and trusted device responses.
Many major technology providers actively recommend passkeys because they can significantly lower the odds of credential theft. However, the new findings highlight that attackers can shift their goals: rather than stealing secrets directly from a login page, they may try to impersonate the device the passkey expects.
Overview of the “Pass-ta-key” approach
The first method, dubbed Pass-ta-key, is tailored to Google-synced passkeys. Researchers describe a scenario where malware already exists on a Windows system running Chrome.
From there, the malware can inspect Chrome’s local synchronization database. That database can reveal which online accounts the user has protected with passkeys, including usernames and encrypted credential material.
Once the malware identifies the relevant accounts, it works to establish a cryptographic capability tied to the user’s device. Specifically, it recovers a device identity key that Chrome stores either on disk or in memory.
No biometric prompt, no elevated privileges
With the device identity key in hand, the malware uses Windows cryptographic APIs to generate a signature over a challenge received from Google’s cloud authenticator service.
Crucially, the researchers report that this can occur without triggering a biometric prompt, without requiring device unlock, and without elevated privileges. The cloud service then treats the signed request as coming from a legitimate trusted device.
How the attacker completes the login
After the cloud authenticator verifies the request, it returns a valid authentication assertion. At that point, the malware (or the attacker behind it) forwards the assertion to the target website, completing the login flow.
In other words, the passkey-protected account is not “phished” in the traditional sense. Instead, the attacker leverages a trusted authentication exchange using signals derived from the compromised browser environment.
“Silver Pass-ta-key” and device re-registration
The research also describes a more advanced variant called Silver Pass-ta-key. This version focuses on changing the setup so the attacker can authenticate later from a different machine.
In this scenario, the malware can force Chrome to enter a device re-registration process. During a brief window in that process, it registers its own user-verification key with the cloud authenticator.
After the re-registration completes, the attacker can perform authentication later from an entirely different device. This extends the impact beyond a one-time login and shifts the problem toward persistent account access.
“Golden Pass-ta-key” and broad decryption risk
The most severe technique is labeled Golden Pass-ta-key. According to the researchers, it attempts to extract a master secret that becomes available briefly in Chrome’s process memory during re-enrollment.
If the attacker obtains that master secret, the implications are far-reaching. The malware can use it to decrypt every synchronized passkey private key associated with the account.
That doesn’t just enable access to what already exists. Because the account’s future synchronized passkeys would also be decryptable in this model, the attacker could continue to gain capability over time, even as new passkeys are created and synchronized.
What this means for real-world defense
These attacks underline a critical security lesson: passkeys protect against many common credential theft methods, but they still rely on the integrity of the device and the browser environment handling the authentication.
Even though the details are specific to Google-synced passkeys and described behaviors in a Windows + Chrome context, the defensive takeaway is broader. You should assume that malware on a trusted workstation can become a powerful stepping stone.
- Reduce the chance of malware: keep systems updated, use reputable security software, and apply strong browser hardening practices where available.
- Detect suspicious browser behavior: watch for unexpected account login attempts, unusual authentication prompts, or abnormal re-registration activity.
- Review logged-in sessions: regularly check active sessions and remove devices you do not recognize.
- Limit exposure where possible: consider separating high-value accounts from everyday browsing activity and downloads.
Mitigations reported by Google
Google has been notified, and the reporting indicates that mitigations have been rolled out. While the specific countermeasures are not listed in the source text, the presence of mitigations suggests the ecosystem is actively adjusting trust and authentication handling.
For users and organizations, this is a reason to stay current with browser and security updates. If you rely on passkeys, ensure your devices and browsers are kept up to date so that any authentication workflow changes and protections can take effect promptly.
Related research signals the bigger authentication trend
This disclosure is part of a wider pattern: attackers increasingly attempt to manipulate authentication workflows rather than just stealing static credentials.
Other related reporting mentioned alongside the main disclosure includes passkey login bypass concepts tied to WebAuthn process manipulation. The takeaway is that the battle is shifting toward the operating environment and the authentication protocol steps, not only toward the login form itself.
Conclusion
The promise of passkeys is real: they can make phishing far less effective and remove the need to type passwords into fraudulent pages. Still, the new research on passkey hijacking shows that attackers can exploit compromised endpoints and browser synchronization mechanisms to impersonate trusted devices.
Methods such as Pass-ta-key, Silver Pass-ta-key, and Golden Pass-ta-key illustrate escalating pathways—from completing logins to registering attacker-controlled verification keys and, in the worst case, decrypting synchronized passkey material. The practical response is to combine passkeys with strong device security, timely updates, and vigilant session management so that trusted authentication cannot be abused by malware.
Source: https://www.securityweek.com/new-attack-methods-enable-malware-to-hijack-passkey-protected-accounts/
