Pass-ta-key: malware hijacks Google-synced passkeys

Passkeys are still better than passwords. But "phishing-resistant" was never the same claim as "malware-resistant," and Unit 42 just published the proof. Three attacks — Pass-ta-key, Silver Pass-ta-key, and Golden Pass-ta-key — let malware already running on a Windows machine take over accounts protected by Google-synced passkeys. No admin rights. No biometric prompt. In the worst case, no access to the victim's device at all.

What actually happened

All three require the same starting condition: malware running locally on a Windows box with a TPM, using Chrome and Google Password Manager. That is a real bar — the attacker already owns the endpoint — but it is the bar most small-business compromises clear on day one.

Pass-ta-key abuses Chrome's TPM-backed device identity key to sign an authentication request, producing a valid assertion with the User Verified flag unset. No privilege escalation, no device unlock, no user interaction. It fails against services that check the UV bit; BleepingComputer reports the researchers demonstrated that limit against GitHub.

Silver Pass-ta-key forces Chrome to re-enroll, then registers the attacker's own user-verification key — because the newly enrolled key isn't attested. The attacker then authenticates as the victim from their own machine, without touching the victim's device.

Golden Pass-ta-key is the one to care about. It triggers re-enrollment and pulls the 32-byte Security Domain Secret out of Chrome's process memory in plaintext. The SDS encrypts every passkey synced to that Google account. With it, an attacker decrypts every synced private key, clones them, and keeps going — and Google Password Manager currently has no mechanism to rotate or revoke an SDS. Google removed the secret from Chrome's logs after the report, but it still reaches the client.

Why passkey security matters for your business

If you run a login, you are a relying party, and you have one control here that costs almost nothing: set userVerification to required and actually verify the UV bit that comes back. Plenty of implementations request UV and never check the response flag. That single check is the difference between GitHub shrugging off the first attack and your app handing over an account.

If you run a company, the lesson is older and less fun. Every one of these attacks starts with code executing on a staff laptop. Passkey rollout does not retire endpoint hardening, EDR, or the boring work of controlling what gets installed. It changes what an infostealer steals — from a password you can rotate to a master secret you currently cannot.

And revocability is now a procurement question. When you evaluate a credential manager, ask what happens after a confirmed endpoint compromise: which secrets rotate, on what command, and how you verify it. "Passkeys are unphishable" is not an answer to that question.

Sources: Unit 42 — Pass the Passkey, BleepingComputer.