Palo Alto Networks researchers have disclosed details regarding a novel class of attack methods targeting passwordless authentication, demonstrating how malware can compromise passkey-protected accounts. According to SecurityWeek, these techniques—collectively named ‘Pass-ta-key’—focus specifically on Google-synced passkeys stored on Windows endpoints. While passkeys are widely adopted due to their resistance to traditional phishing campaigns, these new vectors bypass biometric prompts and device unlocks entirely.
Technical Analysis of Pass-ta-key Techniques
The standard Pass-ta-key attack assumes a scenario where malware is already operating on a Windows machine running the Google Chrome browser. Instead of targeting the authentication prompt directly, the malicious software examines Chrome’s local synchronization database. This allows the threat actor to identify which online accounts utilize passkeys, alongside associated usernames and encrypted credential material.
Once target accounts are identified, the malware recovers a device identity key stored on disk or within the process memory of Chrome. It subsequently leverages legitimate Windows cryptographic APIs to generate a valid cryptographic signature over a challenge received from Google’s cloud authenticator service. Because this process occurs without user interaction, the cloud service treats the request as originating from a trusted, legitimate device and returns an authentication assertion that the attacker forwards to the target website.
Advanced Variants: Silver and Golden Pass-ta-key
Beyond the baseline technique, researchers identified two more severe variants:
- Silver Pass-ta-key: The malware forces Chrome into a device re-registration process. During a brief window, it registers its own user-verification key with the cloud authenticator, enabling future authentication attempts from an entirely different machine.
- Golden Pass-ta-key: The malware extracts a master secret that briefly appears in Chrome’s process memory during re-enrollment. Possession of this master secret allows attackers to decrypt every synchronized passkey private key belonging to the affected account.
Google has been notified of these findings and has reportedly deployed initial mitigations to address the underlying behavior.
Mitigation and Defense Strategies
Defending against authentication framework manipulation requires a multi-layered approach centered on endpoint visibility and credential hygiene:
- Endpoint Detection and Response (EDR): Configure monitoring rules to detect anomalous access to browser synchronization databases, local credential stores, and sensitive Windows cryptographic APIs.
- Process Memory Protection: Implement rigorous memory protection controls to mitigate the risk of threat actors harvesting master secrets during browser re-enrollment or synchronization windows.
- Behavioral Monitoring: Monitor for unauthorized device re-registration requests and unexpected modifications to security keys tied to user accounts.
Related: Hola Browser for Windows Compromised: Cryptominer Delivery via Supply Chain, OkoBot Framework: Multi-Payload Data & Crypto Theft Attacks