Research has found that malware already on a hacked Windows PC can steal Google’s synced passkeys and access the account without the victim having to enter a password, pin or fingerprint. The findings, part of a series examining passkey security, reveal vulnerabilities in how Google’s Cloud Authenticator handles device trust, onboarding, and recovery, undermining the very protections passkeys were designed to provide. “Metadata about synced passkeys is stored by Chrome in a local database that is unencrypted and accessible without elevated privileges to malware,” Unit 42 researchers said.
Chrome’s temporary passkey blob can be read and used by malware to perform full passkey login attacks, called “Pass-ta-key,” using standard Windows cryptography APIs and without triggering device unlock or biometric prompts.
During this period, Cloud Authenticator accepts an attacker-controlled verification key without checking its provenance, allowing the attacker to authenticate as the victim from their own machine with permanent and reusable credentials even for accounts requiring strict multi-factor authentication . Defenders should: Implement rigorous user verification checks Validate device key attestation prior to registration Restrict local access to browser credential stores Monitor for any unexpected re-triggering of onboarding or recovery flows.
