Malware Can Silently Hijack Chrome Passkeys, Researchers Show

Key points

• Researchers at Palo Alto Networks' Unit 42 have shown that malware running as a normal Windows user can abuse Chrome's Google Password Manager to sign into passkey-protected accounts.
• The three techniques, named Pass-ta-key, Silver Pass-ta-key and Golden Pass-ta-key, work without any fingerprint check, PIN entry, or pop-up on the victim's screen.
• The strongest variant, Golden Pass-ta-key, targets the master encryption key that protects the user's stored passkeys.
• The attacks assume the malware is already running with the victim's own permissions, not administrator rights.
• Passkeys stored in cloud-synced password managers now inherit the security of the device they sync to, not the strength of the passkey standard itself.

Passkeys were meant to end the password era. A passkey is a login credential stored on your device that proves who you are using a fingerprint, face scan, or PIN, so there is nothing for a phishing site to steal. Or so the pitch goes.

New research from Palo Alto Networks' Unit 42 pokes a serious hole in that pitch, at least for people who let Chrome's built-in Google Password Manager handle their passkeys.

What did the researchers actually do?

Unit 42 built three attack techniques that let malware, running as the logged-in user on a Windows PC, sign into that user's passkey-protected accounts. No fingerprint. No PIN. Nothing shown on screen. The victim sees nothing at all.

The three methods are named Pass-ta-key, Silver Pass-ta-key and Golden Pass-ta-key. First reported alongside coverage in The Hacker News, they escalate in seriousness. The first abuses the local signing flow. The second reuses tokens tied to the browser session. Golden Pass-ta-key, the worst of the set, goes after the master key that unlocks every passkey the user has stored in the cloud.

How bad is this in practice?

Bad enough to take seriously, not bad enough to panic. The attacks all assume something has already gone wrong: malware is running on the machine as the user. That is a real scenario (a rogue installer, a malicious browser extension, a poisoned download), but it is not a remote hack from nowhere.

What changes here is the assumption underneath passkeys. The whole point of a passkey is that even if attackers steal everything on your disk, they still cannot log in without a live biometric check. These techniques break that promise for Chrome's implementation. Once the malware is in, the passkey behaves a lot like a saved password.

What should ordinary users do?

Do not ditch passkeys. They are still far better than reused passwords, and this research targets one specific implementation, not the standard itself.

A few practical steps:

• If your accounts support it, store passkeys on a hardware security key (a small USB device like a YubiKey) or on your phone rather than in the browser. The malware here targets the browser's cloud-synced store specifically.
• Turn on login alerts for your Google account and any other account that offers them, so a strange sign-in shows up in your inbox.
• Be cautious about browser extensions. Only install ones you actually need, from publishers you recognise.
• Keep Windows and Chrome updated. Google has been notified and typically ships mitigations quickly once research like this lands.

For businesses, the takeaway is sharper. Treat any passkey stored in a cloud-synced consumer password manager as being only as safe as the endpoint it sits on. If the device gets malware, the passkey follows.

Google has not, at time of writing, published its own advisory naming these three techniques. Expect one.