Breaking Lab srl
The Passkey Promise, Quietly Broken
Passkeys have been heralded as the death of the password — a phishing-resistant, cryptographically sound replacement that removes the human from the weakest link in the authentication chain. Major platforms including Google, Apple, and Microsoft have pushed hard for their adoption, and hundreds of millions of users now rely on them. But a new piece of research from Palo Alto Networks’ Unit 42 team suggests the technology’s security guarantees may be more fragile than the industry has been willing to admit — at least when Google Password Manager’s cloud sync feature is in play.
Three Attack Paths, One Uncomfortable Conclusion
Unit 42 researchers identified three distinct attack techniques, collectively branded under the name Pass-ta-key, that allow malware already running on a compromised Windows machine to abuse Google-synced passkeys without triggering any visible authentication prompt on the victim’s screen. No fingerprint scan. No PIN dialog. No user interaction whatsoever.
The first technique, dubbed Pass-ta-key, allows the malware to initiate a silent sign-in to passkey-protected accounts by leveraging the existing trust relationship between the infected machine and the victim’s Google account. The second variant, Silver Pass-ta-key, goes further by enabling the attacker to bypass user verification checks built into the WebAuthn standard — the underlying protocol that makes passkeys work. The most severe path, Golden Pass-ta-key, targets the master key that Google Password Manager uses to protect synced credentials on-device, potentially allowing an attacker to extract raw passkey private keys and use them on entirely separate hardware.
What Makes This Particularly Alarming
The fundamental design assumption behind passkeys is that the private key never leaves the device that created it, and that any use of it requires explicit user verification. Cloud synchronization, a feature Google introduced to make passkeys more practical across multiple devices, necessarily involves those keys being encrypted and transmitted through Google’s infrastructure. Unit 42’s research suggests that on a Windows machine running Chrome with Google Password Manager, the local key material becomes accessible to sufficiently privileged malware without requiring the kind of user interaction that would tip off even a vigilant victim.
Critically, the malware involved does not need to run with administrator privileges to execute the first two attack paths. Ordinary user-level access — the kind a piece of malware dropped via a phishing email or a malicious download would typically obtain — is sufficient. The Golden Pass-ta-key variant does require higher privileges, but privilege escalation is a well-documented and frequently achieved step in modern attack chains.
Google’s Response and the Broader Supply Chain
Unit 42 disclosed its findings to Google through responsible disclosure channels before publication. Google has acknowledged the research, though at the time of writing the company has not issued a public statement detailing specific mitigations or timeline. The researchers note that the core issue is not a simple bug that can be patched in a single update — it reflects inherent tensions between usability (seamless sync across devices) and the strict device-binding that gives passkeys their security properties.
Other password managers and passkey providers that offer cloud sync functionality may face analogous risks, though Unit 42’s research focused specifically on Google’s implementation.
What Users and Enterprises Should Do Now
In the near term, the most effective mitigation remains preventing the initial compromise. Endpoint detection tools, up-to-date OS patches, and careful control over which applications are permitted to run all reduce the attack surface. Enterprise security teams should also evaluate whether passkey cloud sync is appropriate for high-value accounts, or whether hardware-bound passkeys — tied to a physical FIDO2 key that never syncs to any cloud — better match their risk profile.
A Reckoning for the Passwordless Future
The Pass-ta-key research does not mean passkeys are a failed technology — they remain significantly stronger than passwords or SMS-based two-factor authentication against the majority of real-world threats. But it is a pointed reminder that authentication security cannot be evaluated in isolation from the broader endpoint environment. Cloud sync, by definition, expands the attack surface beyond a single device. As passkey adoption accelerates and threat actors sharpen their focus accordingly, the industry will need to grapple honestly with the gap between the clean theoretical model and the messy reality of consumer operating systems, credential managers, and malware that operates well within what the OS considers normal behaviour.
