New "Pass-ta-Key" Attack: Malware Hijacks Google-Synced Passkeys

Researchers have described Pass-ta-Key attacks, where malware running on a victim's device abuses authenticated sessions or synced credentials to use Google-synchronized passkeys. The attack does not break the underlying FIDO2/WebAuthn cryptography. Instead, it compromises the endpoint and leverages access that already exists on the infected device.

How the attack works

• A victim's Windows or Android device is infected with malware.
• The victim is already signed in to their Google account.
• Google Password Manager stores and syncs passkeys across devices.
• Malware abuses the authenticated session or exported credential material to authenticate as the victim.
• Attackers gain access to passkey-protected services without stealing traditional passwords.

Why this matters

• Passkeys remain resistant to phishing.
• The weakness is endpoint compromise, not the passkey standard.
• Organizations relying solely on passkeys should also prioritize endpoint security and device trust.

Potential impact

• Account takeover
• Unauthorized access to cloud services
• Enterprise identity compromise
• Persistent access through synced credentials

Mitigation

• Deploy strong Endpoint Detection and Response (EDR).
• Keep operating systems and browsers updated.
• Enable Google Advanced Protection for high-risk users where appropriate.
• Use hardware security keys for privileged accounts.
• Restrict synchronization on unmanaged devices.
• Monitor for suspicious device registrations and new sign-ins.
• Enforce conditional access and device compliance policies.

Conclusion

Passkeys are not broken. The Pass-ta-Key attack demonstrates that if malware fully compromises a trusted device, attackers can abuse that trusted state. This reinforces a core security principle: identity security is only as strong as endpoint security.