Plan
active
Pass-ta-key: Malware Can Hijack Google Passkeys Without User Interaction
- Engineer — Learn: Unit 42’s three attack paths show that malware with ordinary user privileges can silently sign into passkey-protected accounts via Chrome’s Google Password Manager cloud authenticator, undermining the assumption that passkeys are malware-resistant. No patch is available; understand this changes the trust model for GPM-backed passkeys as a control and evaluate whether hardware-bound keys or platform authenticators offer stronger guarantees for high-value accounts.
- SOC/IR — Plan: The three named techniques (Pass-ta-key variants) targeting Chrome’s credential store represent detectable post-exploitation behaviors; build detections around suspicious process access to Chrome’s local password/passkey storage and anomalous silent authentication events originating from endpoints, even without prior IOCs.
- Leader — Learn: Research demonstrates that passkeys stored in Google Password Manager do not provide the malware-resistance often assumed in enterprise migration pitches; factor this into any planned passkey rollout strategy and update risk narratives shared with leadership or customers around phishing-resistant MFA claims.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.