Google Password Manager Attacks Let Malware Hijack Passkey-Protected Accounts

Summary

Palo Alto Networks Unit 42 detailed three attack paths against Chrome's Google Password Manager cloud authenticator — Pass-ta-key, Silver Pass-ta-key, and Golden Pass-ta-key — showing that malware running as an ordinary user on Windows can silently hijack passkey-protected accounts without biometric verification.

Details

Unit 42's research identified three distinct attack paths:

• Pass-ta-key: Silently obtains a valid authentication assertion without user verification.
• Silver Pass-ta-key: Installs an attacker-controlled user-verification key.
• Golden Pass-ta-key: Extracts the 32-byte Security Domain Secret (SDS) used to decrypt all synced passkey private keys.

Malware running as an ordinary user on Windows can sign into a victim's passkey-protected accounts without a fingerprint, PIN, or anything appearing on screen. The attacks go after the code around the passkey — how Chrome stores its device keys, how it re-enrolls a device after state loss, and whether the relying party checks human verification.

Australian Context

These attacks carry immediate implications for Australian organisations adopting passkey-based authentication under the ACSC Essential Eight application control and multifactor authentication guidance. The ASD's ACSC has advocated passkey adoption as a phishing-resistant authentication method — these attacks target the implementation layer, not the cryptographic primitives, meaning organisations should review how Chrome-based passkey storage and cloud sync are configured on managed devices.

Sources

• The Hacker News
• Palo Alto Networks Unit 42 research