Researchers Find Holes in Google Password Manager That Bypass Passkey Protections
Once the machine is infected, the “unphishable” login can get hijacked without a fingerprint, PIN, or any warning on the screen
Passkeys were supposed to end the password mess. Google sold them as safer—no more stolen passwords, no more phishing tricks. Just use your fingerprint or PIN and you’re good. The keys stay on your device, they said, and can’t be copied.
Turns out that promise has a hole in it. Researchers at Palo Alto Networks’ Unit 42 found that malware already running on a Windows computer can quietly take over accounts protected by Google’s synced passkeys. No biometric check. No PIN prompt. Nothing shows up on the screen.
They laid out three ways this happens, all working with normal user rights—no admin privileges needed. The first, called Pass-ta-key, grabs Chrome’s device identity key and uses the computer’s TPM chip to sign login requests. Google’s system thinks it’s a trusted device and hands over a valid login. Some websites that don’t carefully check the “user verified” flag get taken over right then.
The second method, Silver Pass-ta-key, forces the device to re-register. During that short window the malware slips in its own verification key. After that the attacker can log in from a different computer altogether.
The worst one is Golden Pass-ta-key. It forces a re-enrollment and snatches the master secret—the 32-byte key that protects every synced passkey on the Google account—while it sits briefly in Chrome’s memory. With that secret, the private keys can be decrypted and used somewhere else. Right now Google doesn’t give users a clear way to change or cancel that secret.
These attacks only work after the computer is already infected. That’s the reality of everyday malware, though. Infostealers land on machines all the time. Once they’re in, the passwordless system doesn’t fully protect the accounts the way the ads suggested.
This is familiar with big tech companies. They push convenience and sync features, then the details around the hardware leave openings. Hardware-backed keys sound solid until the software exports the wrong blobs or leaves secrets sitting in memory. Sites that skip strict checks make it easier.
Passkeys are still better than regular passwords against remote phishing. They’re not a silver bullet. Keeping malware off the machine still matters more than any new login method. Big tech talks up the next big security fix. Users still have to watch what actually runs on their own computers.
Sources / More reading
Unit 42 research: https://unit42.paloaltonetworks.com/passwordless-authentication-security-risks/
The Hacker News: https://thehackernews.com/2026/08/google-password-manager-attacks-could.html
BleepingComputer: https://www.bleepingcomputer.com/news/security/new-pass-ta-key-attacks-let-malware-hijack-google-synced-passkeys/
SecurityWeek: https://www.securityweek.com/new-attack-methods-enable-malware-to-hijack-passkey-protected-accounts/
Android Authority: https://www.androidauthority.com/google-password-manager-synced-passkey-vulnerabilities-3694433/
The Hacker News X post: https://x.com/TheHackersNews/status/2084985085644951769