Back Feeds.4Sysops

Malware can silently hijack Chrome’s synced passkeys on Windows

Feeds.4Sysops •IT News • August 3, 2026

Malware with ordinary user privileges can bypass the protections users expect from Google Password Manager passkeys, including fingerprints, PINs, and visible prompts. Unit 42 identified three attack paths against Chrome’s Google Cloud Authenticator that can produce valid login assertions or extract synced passkey keys without breaking passkey cryptography. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

New Malware Attacks Exploit Google Passkeys on Windows Devices Security researchers from Palo Alto Networks' Unit 42 have identified three attack methods, collectively termed 'Pass-ta-key', that enable malware on compromised Windows devices to hijack Google Password Manager's synced passkeys. These attacks exploit vulnerabilities in Chrome and Google's cloud authenticator, allowing malware to impersonate trusted devices and bypass user verification methods such as fingerprints and PINs. The first attack allows malware to request valid authentication responses without user interaction, while the second enables attackers to register their own user-verification keys. Although the attacks do not break passkey cryptography, they can extract passkey private keys or produce valid login assertions. Affected systems include Windows devices using Chrome with Google Password Manager. The attacks have been confirmed to work against services like eBay, which failed to properly validate user verification flags. Google has been notified, and affected services are urged to implement proper validation to mitigate these vulnerabilities. 9 sources 68

Extracted Entities

Malware can silently hijack Chrome’s synced passkeys on Windows

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

Platforms (3)

Tools (1)