New Attack Methods Enable Malware to Hijack Passkey-Protected Accounts

Palo Alto Networks researchers have demonstrated attacks against Google’s synced passkey implementation. The post New Attack Methods Enable Malware to Hijack Passkey-Protected Accounts appeared first on SecurityWeek .

According to Palo Alto Networks' Unit 42, the 'Pass-ta-key' family of attacks shows that malware on a compromised endpoint can hijack Google-synced passkeys by abusing Chrome’s local sync database, device identity keys, and re-enrollment workflows, culminating in Golden Pass-ta-key, which can extract all synced passkeys from Chrome process memory.[1][2][5] These attacks do not break passkey cryptography but exploit weaknesses in the surrounding browser and cloud infrastructure, enabling account takeover without user interaction or privilege escalation.[1][2] From a RealGround perspective, any SaaS product or AI-driven service that relies on synced passkeys or browser-based WebAuthn flows inherits this endpoint and cloud-sync exposure, so organizations should treat synced passkeys as a high-value dependency, harden endpoint and browser security, and evaluate alternative passkey models (e.g., hardware-bound) as part of an AI Security Readiness Assessment.