Palo Alto Networks researchers have disclosed the details of new attack methods targeting passwordless authentication, showing how malware can hijack a passkey-protected account.
Passkeys are increasingly adopted by tech giants and are widely recommended because they are more secure against phishing.
The new attack methods, named ‘Pass-ta-key’ by Palo Alto Networks, focus on Google-synced passkeys. The security firm’s researchers showed how a threat actor could use the techniques to take over accounts without needing privilege escalation or user interaction.
In a Pass-ta-key attack, malware already present on a Windows machine running Chrome can examine the browser’s local synchronization database to identify which online accounts the user has protected with passkeys, along with associated usernames and encrypted credential material.
The malware recovers a device identity key that Chrome stores on disk or in memory. It then uses Windows cryptographic APIs to generate a signature over a challenge received from Google’s cloud authenticator service, without any biometric prompt, device unlock, or elevated privileges.
The cloud service treats the signed request as coming from a legitimate trusted device. It returns a valid authentication assertion, which the attacker forwards to the target website to complete the login.
In a more advanced variant, dubbed ‘Silver Pass-ta-key’, the malware forces Chrome into a device re-registration process. During a short window in that process, it registers its own user-verification key with the cloud authenticator. Once registered, the attacker can later authenticate from a completely different machine.
The most severe technique, ‘Golden Pass-ta-key’, extracts a master secret that briefly appears in Chrome’s process memory during re-enrollment. Possession of this secret allows the malware to decrypt every synchronized passkey private key belonging to the account, enabling the attacker to decrypt future passkeys as well.
Google has been notified and Palo Alto Networks’ blog post indicates that it has rolled out some mitigations.
Related: Passkey Login Bypassed via WebAuthn Process Manipulation
Related: TP-Link Omada ZTP Vulnerabilities Chain Into Full Network Takeover
Related: Gemini Agent-to-Agent Attack Method Exposed Secrets, Enabled Pull Request Tampering
