Security researchers have uncovered a set of post-compromise attack techniques that allow malware running on a Windows computer to access passkey-protected accounts without requiring a fingerprint, PIN, or any visible authentication prompt.
The attacks target Google Password Manager in Chrome on Windows systems equipped with a Trusted Platform Module (TPM), but they do not break the underlying passkey cryptography.
Researchers from Palo Alto Networks’ Unit 42 identified three attack methods—named Pass-ta-key, Silver Pass-ta-key, and Golden Pass-ta-key—that exploit how Chrome stores and manages passkeys after a device has already been compromised. Rather than defeating passkey encryption itself, the attacks abuse the surrounding software logic, including device key storage, device re-enrollment, and website validation of user verification.
All three techniques require malware to already be running on the victim’s computer. The attacks begin by reading metadata from Chrome’s local profile, allowing the malware to identify websites and usernames associated with the victim’s synchronized passkeys, along with encrypted credential information.
The first technique, Pass-ta-key, uses the victim’s own TPM to generate a valid authentication response without confirming the user’s identity. While the authentication response does not include the required “User Verified” flag, researchers found that websites failing to properly enforce this security check could still accept the login. GitHub correctly rejected these authentication attempts, while eBay reportedly accepted them until the issue was fixed following responsible disclosure.
The second method, Silver Pass-ta-key, forces Chrome to re-register the device and takes advantage of a brief period before a legitimate user verification key is created. During this window, malware can register an attacker-controlled verification key, potentially enabling future logins from another device while still appearing as if user verification had occurred.
The most advanced technique, Golden Pass-ta-key, targets the 32-byte Security Domain Secret (SDS) used to decrypt synchronized passkey private keys. According to the researchers, malware can capture this secret from Chrome’s memory during device re-enrollment, allowing attackers to recover synchronized passkey data and potentially maintain access from their own systems after the initial compromise.
The researchers emphasized that these are post-compromise attacks, meaning they only work after malware has already infected the victim’s Windows computer. There is currently no evidence that these techniques have been exploited in real-world attacks, and no CVE identifiers have been assigned. Searches of the National Vulnerability Database also found no matching vulnerabilities.
To reduce the risk of these attacks, researchers recommend that websites require and verify the WebAuthn User Verified (UV) flag during passkey authentication instead of simply requesting it. They also advise credential providers to verify newly enrolled authentication keys using hardware attestation, strengthen device re-registration protections, limit access to locally stored passkey data, and avoid exposing sensitive master secrets in logs or application memory.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
Google has not publicly confirmed whether all of the reported attack paths have been fully addressed. The company’s current Password Manager documentation also does not explain whether changing a Google Password Manager PIN or deleting Password Manager data invalidates a previously stolen Security Domain Secret, leaving uncertainty for users who suspect their systems may have been compromised.
