Security researchers at Unit 42, the threat-intelligence arm of Palo Alto Networks, have exposed a family of attacks that rattles one of the core promises of passwordless authentication: that passkeys synced to the cloud are safe from theft. Dubbed Pass-ta-key, the family comprises three techniques — Pass-ta-key, Silver Pass-ta-key and Golden Pass-ta-key — that target Google Password Manager inside Chrome on Windows devices equipped with a Trusted Platform Module (TPM). The striking detail is that none of them breaks the cryptography. Instead, they exploit weaknesses in how Chrome and Google's cloud authenticator handle device trust, onboarding, recovery and synced credentials.
The starting point is realistic and, for that reason, unsettling. All three attacks require malware to already be running on the victim's machine. On an already-compromised device, the attacker can read or alter the Chrome profile, talk to the TPM and inspect process memory. From there, stealing the synced passkeys happens without the user ever typing a password, entering a PIN or using biometrics. In the Golden scenario, for example, malware forces a fresh device enrollment, reads the 32-byte Security Domain Secret (SDS) while it briefly sits in plaintext in Chrome's memory, and uses it to decrypt every synced passkey on the account. The aggravating factor: Google offers no way to rotate that master secret. In the Silver scenario, the attacker deletes the local enclave state file, forcing Chrome to re-enroll the device. During that flow, the browser briefly defers creating the user verification key, and the attacker registers their own key in the gap. Because the cloud authenticator never validates attestation on the new key, assertions signed by it carry the User Verified flag set to 1.
To gauge the impact, it helps to recall how synced passkeys work. Unlike hardware passkeys, which stay locked to a physical token, passkeys synced through Google Password Manager travel with the account. They let a user reach services across many devices with the same key pair, guarded by a master key stored in Google's cloud. That model is what makes the experience convenient, but it also concentrates the risk: everything once scattered across physical tokens now depends on a single secret and on the trust Google places in the device. When local malware can manipulate that trust, the weakest link is no longer the cryptography — it is the management of trust itself.
The implication runs deep for the passwordless movement. The industry sold passkeys as the definitive replacement for passwords, capable of resisting phishing and credential theft. Pass-ta-key does not dismantle that argument on paper — it shows the protection is worth little once the device is already compromised. No magic fix emerges. The researchers disclosed responsibly and did not describe an active criminal campaign, which offers relief but not complacency: the technique reinforces that local compromise remains the most dangerous attack surface in any authentication model. The open question stands: if the Golden master secret cannot be rotated, what will Google — and the passkey industry at large — do to make device trust a less lucrative target for malware?
Sources: BleepingComputer, The Hacker News, Gridinsoft
✓ Independent sources cross-checked and verified before publishing
