MalwarePublished 3 Aug 2026

New Pass-ta-key attacks let malware hijack Google-synced passkeys

Source Bleeping Computer

Description

Security researchers have discovered three attacks that allow malware on already-compromised Windows devices to abuse Google Password Manager's synced passkeys to take over accounts, bypass user verification, and extract passkey private keys. [...]

Impact

Malware already present on a victim's Windows device can abuse Google Password Manager's synced passkeys to take over user accounts by impersonating trusted devices and bypassing user verification in some cases. Attackers can register their own verification keys to bypass user verification requirements and extract the master key used to encrypt all synced passkeys, enabling decryption and theft of private keys. This compromises the security of passkey-based authentication for affected users, potentially allowing account takeover and persistent access. The attacks do not compromise passkey cryptography itself but exploit weaknesses in device trust, key registration, and memory handling. Some affected services have fixed validation flaws, but the master key exposure remains a critical concern.

Defensive guidance

Researchers disclosed these issues to Google and affected services such as eBay, which has fixed related user verification validation flaws. Until official fixes are confirmed, websites should require and properly validate user verification flags during passkey authentication. Credential managers should validate newly registered device keys, harden recovery and device re-registration processes, and prevent master keys from being accessible in browser memory. Users should ensure their devices are free from malware, as these attacks require pre-existing compromise. Monitor vendor advisories for updates on patches or official mitigations.

References

bleepingcomputer.com/news/security/new-pass-ta-key-attacks-let-malware-hijack-google-synced-passkeys/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 4 Aug 2026, 00:03 UTC

References

Community reviews

Related threats