Critical cybersecurity update: New Attack Methods Enable Malware to Hijack Passkey-Protected Accounts. NetworkFix reviewed the available source material to summarize the security issue, its potential impact and the defensive actions administrators should prioritize.
What Happened
Palo Alto Networks researchers have demonstrated attacks against Google’s synced passkey implementation. The post New Attack Methods Enable Malware to Hijack Passkey-Protected Accounts appeared first on SecurityWeek . New Attack Methods Enable Malware to Hijack Passkey-Protected Accounts – SecurityWeek Palo Alto Networks researchers have disclosed the details of new attack methods targeting passwordless authentication, showing how malware can hijack a passkey-protected account. Passkeys are increasingly adopted by tech giants and are widely recommended because they are more secure against phishing. The new attack methods, named ‘Pass-ta-key’ by Palo Alto Networks, focus on Google-synced passkeys. The security firm’s researchers showed how a threat actor could use the techniques to take over accounts without needing privilege escalation or user interaction. In a Pass-ta-key attack, malware already present on a Windows machine running Chrome can examine the browser’s local synchronization database to identify which online accounts the user has protected with passkeys, along with associated usernames and encrypted credential material. The malware recovers a device identity key that Chrome stores on disk or in memory.
Technical Details
It then uses Windows cryptographic APIs to generate a signature over a challenge received from Google’s cloud authenticator service, without any biometric prompt, device unlock, or elevated privileges. The cloud service treats the signed request as coming from a legitimate trusted device. It returns a valid authentication assertion, which the attacker forwards to the target website to complete the login. In a more advanced variant, dubbed ‘Silver Pass-ta-key’, the malware forces Chrome into a device re-registration process. During a short window in that process, it registers its own user-verification key with the cloud authenticator. Once registered, the attacker can later authenticate from a completely different machine. The most severe technique, ‘Golden Pass-ta-key’, extracts a master secret that briefly appears in Chrome’s process memory during re-enrollment. Possession of this secret allows the malware to decrypt every synchronized passkey private key belonging to the account, enabling the attacker to decrypt future passkeys as well. Google has been notified and Palo Alto Networks’ blog post indicates that it has rolled out some mitigations.
Security Impact
Organizations using the affected technology should treat the report according to its critical severity classification. Related : Passkey Login Bypassed via WebAuthn Process Manipulation Related : TP-Link Omada ZTP Vulnerabilities Chain Into Full Network Takeover Related : Gemini Agent-to-Agent Attack Method Exposed Secrets, Enabled Pull Request Tampering Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering. TP-Link Omada ZTP Vulnerabilities Chain Into Full Network Takeover Microsoft Bug Bounty Program: $20 Million Paid to 500 Researchers N‑able Patches Vulnerability Exploited to Hack N-central Servers US Water Cyberattacks Extend Beyond Minnesota to at Least 6 Other States Prompted by OpenAI Disclosure, Anthropic Finds Its Own Models Hacked 3 Organizations 1 in 5 Data Center Assets Are Within Easy Reach of Attackers Cisco Secure FMC Zero-Day Exploited in the Wild Black Hat USA 2026 – Summary of Vendor Announcements (Part 3) The Fourth Battlefield: The Growing Role of Cyber Operations in Global Conflict 311,000 Impacted by Brown Health Medical Group-MA Data Breach Cybersecurity Alliance Drafts SAFE Guidelines for Sharing AI Incident Data AI Agents Targeted Real People and Projects During Cybersecurity Tests CISA Warns of Exploited Langflow, N-central, and Tomcat Vulnerabilities Over 400 NPM Packages Infected in ChainDrop Supply Chain Attack Water Sector Cyberattacks Reportedly Hit at Least 12 States Join this live webinar as we explore if detection-first security operations can keep pace with AI, or if it’s time to rethink prevention as the strongest default. CodeSecCon bridges the gap between dev and security. Discover best practices for secure coding, innovative risk-reduction tools, and safe AI integration to cultivate a true DevSecOps culture. James Wilkinson has been named Chief Information Security Officer for the City of Dallas.
Recommended Actions
- Identify whether the affected product, service or software is present in the environment.
- Review the original vendor or research advisory and verify affected versions before making configuration changes.
- Apply vendor-provided security updates or mitigations as soon as operationally practical.
- Review relevant security logs and monitoring alerts for signs of suspicious activity associated with the reported issue.
- Use the CVE identifiers, where available, to validate exposure through vulnerability-management and asset-inventory tools.
Security Details
- Severity: Critical
- Original source: SecurityWeek
Why This Matters
Cybersecurity teams should use reports like this as an input to risk-based vulnerability and threat management rather than relying on headline severity alone. Exposure depends on whether the affected technology is deployed, reachable by an attacker and protected by compensating controls. Confirming asset ownership, affected versions and available vendor fixes helps teams prioritize remediation while avoiding unnecessary emergency changes.
Original Report
NetworkFix recommends reviewing the complete original report from SecurityWeek for the authoritative technical context, affected versions, indicators and vendor-specific remediation details: Read the original report.
