New Malware Attacks Exploit Google Passkeys on Windows Devices

• •Three novel attacks exploit Google Password Manager's synced passkeys on Windows.
• •Malware can bypass user verification methods, including biometrics and PINs.
• •eBay was affected due to improper validation of user verification flags.

Security researchers from Palo Alto Networks' Unit 42 have identified three attack methods, collectively termed 'Pass-ta-key', that enable malware on compromised Windows devices to hijack Google Password Manager's synced passkeys. These attacks exploit vulnerabilities in Chrome and Google's cloud authenticator, allowing malware to impersonate trusted devices and bypass user verification methods such as fingerprints and PINs. The first attack allows malware to request valid authentication responses without user interaction, while the second enables attackers to register their own user-verification keys. Although the attacks do not break passkey cryptography, they can extract passkey private keys or produce valid login assertions. Affected systems include Windows devices using Chrome with Google Password Manager. The attacks have been confirmed to work against services like eBay, which failed to properly validate user verification flags. Google has been notified, and affected services are urged to implement proper validation to mitigate these vulnerabilities.