Security researchers from Palo Alto Networks’ Unit 42 have discovered three attack paths that allow malware on already-compromised Windows devices to bypass user verification, take over accounts, and extract passkey private keys through Google Password Manager.
New Pass-ta-key
Attacks Target Google Password Manager Passkeys
The research focuses on Google Password Manager in Chrome on Windows devices equipped with a Trusted Platform Module. According to The Hacker News, the techniques do not break the underlying cryptography. Instead, the attacks target the surrounding code—such as how Chrome stores device keys, how devices are re-enrolled, and whether relying party websites check if a human was actually verified. Every path begins with local reconnaissance on a machine where malware is already running.
Three Distinct Attack Paths
The research outlines three specific methods collectively known as 9to5Google:
* Pass-ta-key: Unprivileged malware extracts Chrome’s wrapped device identity key and uses Windows Cryptography API: Next Generation calls to ask the TPM to sign an attacker-controlled request. This obtains a valid authentication assertion without requiring administrator privileges, user interaction, biometrics, or a PIN. * Silver Pass-ta-key: Malware forces Chrome to re-enroll the device by invalidating its existing verification key or deleting the local file containing its passkey state. During this re-enrollment window, the malware registers an attacker-controlled user-verification key because the cloud authenticator does not check whether the new key originated from secure hardware. * Golden Pass-ta-key: Malware triggers re-enrollment and reads the 32-byte Security Domain Secret (SDS) directly out of Chrome’s process memory while it briefly sits there in plaintext. The attacker can then use this master key to decrypt synced passkey private records.
Platform Vulnerabilities and Service Validation
During testing, Unit 42 found that the initial Pass-ta-key method failed against GitHub because the service properly checked the user-verified flag. However, the attack successfully tested against eBay, which required user verification but failed to properly validate the flag indicating whether that verification actually occurred. eBay has since fixed the issue after being notified by the researchers.
Regarding the strongest method, Unit 42 notes that although Google removed the security domain secret from Chrome’s logging output following the report, the SDS is still sent to the client and remains accessible in Chrome’s process memory during re-registration.
Context and Protection Recommendations
Passkeys rely on public-key cryptography where a private key stays on the user’s device and websites only see public keys and signed challenges. By the end of 2024, Google reported that 800 million accounts used passkeys as a phishing-resistant alternative to traditional passwords.
According to Malwarebytes, the findings highlight that while passkeys remain strong against phishing and credential stuffing, the software implementation, synchronization mechanisms, and server-side trust models still contain endpoint and onboarding weaknesses. Researchers urge services to properly validate user-verification flags, encourage Google to harden device registration, and advise end users to maintain basic anti-malware hygiene, keep systems patched, and use up-to-date real-time protection.
