MalwarePublished 5 Aug 2026

New Attack Methods Enable Malware to Hijack Passkey-Protected Accounts

Source SecurityWeek

malware

Description

Palo Alto Networks researchers have demonstrated attacks against Google’s synced passkey implementation. The post New Attack Methods Enable Malware to Hijack Passkey-Protected Accounts appeared first on SecurityWeek .

Impact

The attacks enable malware to hijack accounts protected by Google’s synced passkeys without requiring user interaction, privilege escalation, or biometric verification. This compromises the security benefits of passkeys, potentially allowing attackers full account takeover. The Golden Pass-ta-key variant is especially severe, as it allows decryption of all synchronized passkeys for the account, enabling persistent and broad access. These attacks undermine the trust model of passwordless authentication relying on device-bound credentials.

Defensive guidance

Google has been notified of these attack methods and has rolled out mitigations to address them. Users should ensure their Chrome browsers and related software are updated to the latest versions incorporating these fixes. No additional user action is specified or required at this time according to the vendor disclosure. Organizations should monitor vendor advisories for further updates.

References

securityweek.com/new-attack-methods-enable-malware-to-hijack-passkey-protected-accounts/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 5 Aug 2026, 12:56 UTC

References

Community reviews

Related threats