Malware Can Steal Your Google Synced Passkey Without Asking for Your Password or Fingerprint

Cybersecuritynews •Guru Baran • August 3, 2026

New research reveals that malware already sitting on a compromised Windows PC can hijack Google’s synced passkeys and take over accounts without ever prompting the victim for a password, PIN, or fingerprint. The findings, detailed in the third part of a series examining passkey security, expose flaws in how Google’s Cloud Authenticator handles device trust, […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

New Malware Attacks Exploit Google Passkeys on Windows Devices Security researchers from Palo Alto Networks' Unit 42 have identified three attack methods, collectively termed 'Pass-ta-key', that enable malware on compromised Windows devices to hijack Google Password Manager's synced passkeys. These attacks exploit vulnerabilities in Chrome and Google's cloud authenticator, allowing malware to impersonate trusted devices and bypass user verification methods such as fingerprints and PINs. The first attack allows malware to request valid authentication responses without user interaction, while the second enables attackers to register their own user-verification keys. Although the attacks do not break passkey cryptography, they can extract passkey private keys or produce valid login assertions. Affected systems include Windows devices using Chrome with Google Password Manager. The attacks have been confirmed to work against services like eBay, which failed to properly validate user verification flags. Google has been notified, and affected services are urged to implement proper validation to mitigate these vulnerabilities. 9 sources 68

Extracted Entities

Malware Can Steal Your Google Synced Passkey Without Asking for Your Password or Fingerprint

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

Platforms (2)