Warning: New attack technique enables malware to hijack Google Passkey authentication keys

Passwordless authentication (Passkey) has been widely adopted and recommended by major tech corporations due to its effectiveness in countering phishing attempts. However, cybersecurity experts at Palo Alto Networks recently discovered a new attack chain dubbed "Pass-ta-key," which enables malware to compromise and hijack accounts even when protected by this mechanism.

How malware bypasses passwordless security systems

The "Pass-ta-key" attack technique directly targets Google's passkey synchronization feature. When a Windows-based PC running the Chrome browser is infected with malware, attackers can operate without privilege escalation or requiring any user interaction.

Initially, the malware scans the browser's locally stored synchronization database to locate accounts utilizing passkeys, along with their associated usernames and encrypted authentication data. The hijacking process then unfolds through the following steps:

• Device key extraction: The malware recovers the device identity key stored in memory or on the local disk.

• Forged signature generation: Utilizing Windows cryptographic Application Programming Interfaces (APIs), the malware generates a valid signature for the challenge issued by Google’s cloud authentication service. This process requires zero biometrics (fingerprint or facial recognition) or device unlocking actions.

• Gaining access: Upon receiving the validly signed request, the cloud service assumes it originates from a trusted device and returns a login confirmation. The malware simply sends this confirmation to the target website to achieve a successful login.

Two advanced variants: "Silver" and "Golden" Pass-ta-key

www.ipsip.vn

Google Password Manager attacks could hijack passkey-protected accounts

Unit 42 disclosed three techniques that could let malware hijack passkey-protected accounts on Chrome for Windows after a device is compromised.

Beyond the baseline method, Palo Alto Networks highlighted two more dangerous attack forms that allow threat actors to maintain persistent access:

• Silver Pass-ta-key: The malware interferes to force Chrome to re-register the device. During this brief re-registration window, it injects the attacker's own verification key into the cloud authentication service. Consequently, hackers can log into the victim's account from an entirely unfamiliar computer at a later time.

• Golden Pass-ta-key: This is the most severe variant. The malware steals a master secret that temporarily resides in Chrome’s process memory during device re-registration. Armed with this master secret, attackers gain the ability to decrypt all synchronized passkey private keys for the account, as well as any passkeys generated in the future.

Upon discovering these security risks, the research team promptly notified Google, which has begun implementing necessary mitigation measures to protect users. This finding demonstrates that regardless of how advanced authentication technologies become, threat actors continuously discover implementation flaws to bypass security barriers.

Expert advice from IPSIP Vietnam: Defensive solutions against the Pass-ta-key technique

Given the sophistication of the "Pass-ta-key" attack technique exploiting browser sync flaws, cybersecurity experts at IPSIP Vietnam emphasize that enterprises cannot rely solely on platform-level authentication mechanisms. Since the root cause stems from endpoints being infected with malware, defenses must be rigorously established right at the network and endpoint levels.

IPSIP Vietnam is a trusted cybersecurity expert providing optimal solutions for enterprise infrastructure

To protect data safety, IPSIP Vietnam recommends the following in-depth solutions:

• 24/7 Endpoint monitoring and protection: Deploying a Security Operations Center (SOC 24/7) combined with Extended Detection and Response (XDR) systems serves as a vital first line of defense. IPSIP’s team of experts continuously monitors and detects anomalous access to Chrome memory spaces or system databases, neutralizing malware before it can extract device keys.

• Regular Vulnerability assessment & Penetration Testing (Pentest): Attackers often exploit system weaknesses to deliver malware. Utilizing periodic Security Assessment & Penetration Testing services enables businesses to proactively identify and patch OS vulnerabilities before threat actors can exploit them as entry points.

• Privileged Access Management (PAM): Although the "Pass-ta-key" malware does not require privilege escalation, enforcing strict access controls via PAM solutions minimizes malware's operational footprint, preventing it from easily reading master secrets in memory.

• Employee security awareness training: Malware frequently infects systems via phishing emails or accidental downloads of malicious files. IPSIP’s cybersecurity awareness training programs equip staff with risk recognition skills, mitigating infection risks at the perimeter.

---

Reference:

New Attack Methods Enable Malware to Hijack Passkey-Protected Accounts - Securityweek