Malware Can Steal Google Passkeys on Windows: The Golden Pass-ta-key Exploit

Passkeys were hailed as the ultimate defense against credential theft, but a new discovery proves they are not immune to local threats. Security researchers at Palo Alto Networks’ Unit 42 have revealed that malware running on Windows PCs can exploit device trust gaps to compromise synced passkeys within Google Password Manager.

The vulnerability does not break the underlying cryptography of the passkeys themselves. Instead, it targets how Google Password Manager handles synced passkeys in Chrome on Windows devices equipped with a Trusted Platform Module (TPM). Because the attack requires malware to already be active on the victim's machine, it highlights a critical flaw in endpoint device trust rather than a remote exploit against Google accounts.

The Unit 42 team identified three distinct attack paths, each escalating in severity and exploiting different onboarding and recovery mechanisms:

• Pass-ta-key: This method allows malware to authenticate without triggering Windows Hello or biometric verification. However, it is limited to services that do not strictly enforce user verification.
• Silver Pass-ta-key: Bypassing the limitations of the first method, this attack registers an attacker-controlled verification key. Researchers successfully demonstrated this technique against eBay before responsibly disclosing it, prompting eBay to patch the vulnerability.
• Golden Pass-ta-key: The most severe exploit allows attackers to extract the master secret protecting the synced passkeys. Once recovered, the malware can decrypt every single passkey tied to the user's account. While Google has removed the secret from Chrome’s debug logs, Unit 42 warns it remains recoverable from memory during device re-registration.

Since these exploits rely entirely on local malware execution, endpoint security is your primary defense against passkey extraction.

• Maintain active endpoint protection and run frequent malware scans to catch malicious payloads before they execute.
• Avoid downloading software from untrusted sources, as this is the primary vector for the malware required to execute the Pass-ta-key attacks.
• Keep Google Chrome and your Windows operating system updated to ensure you receive the latest patches for memory management and debug logging.

The tech industry has spent years marketing passkeys as the silver bullet for authentication, but this Unit 42 research serves as a necessary reality check. The cryptography held up perfectly, yet the system still failed because it inherently trusts the device it operates on. If a Windows PC is compromised by malware, the authentication system built on top of it is fundamentally compromised as well.

This exposes a glaring gap in how tech giants handle recovery mechanisms. The fact that a master secret can be extracted from memory during device re-registration - and cannot be rotated or revoked once stolen - is a significant architectural oversight. As passkey adoption grows, companies like Google must prioritize secure enclave isolation and robust revocation protocols, rather than assuming the host operating system is a safe haven.