Passkey Attacks Show Why Account Security Still Depends on Device Security

Overview

Unit 42 describes new attack techniques against the way Google Password Manager handles synced passkeys in Chrome on Windows devices. The techniques are named Pass-ta-key, Silver Pass-ta-key and Golden Pass-ta-key.

The topic matters because passkeys are often viewed as a much stronger phishing-resistant alternative to passwords. That remains true. But the research highlights an important boundary: if the device itself is already compromised by malware, attackers may abuse the local context around passkey authentication.

This does not “break” passkey cryptography. The risk is in the real environment around it: browser behavior, operating system handling, locally stored keys, synchronization and whether user verification is properly checked.

What Happened

According to public reporting, the research focuses on Google Password Manager in Chrome on Windows systems with TPM (Trusted Platform Module) support.

All described techniques begin with an already compromised device. This means the attack does not explain how malware first lands on the machine, but what it can do after it is already running there.

Unit 42 describes three possible paths:

• Pass-ta-key — abuse of a locally stored device identity key;
• Silver Pass-ta-key — device re-enrollment and attacker-controlled verification material;
• Golden Pass-ta-key — attempted access to a core secret used to protect synced passkeys.

The key clarification: at this stage, there is no public CVE identifier and no confirmed evidence of active exploitation in the wild.

Why This Matters

Passkeys reduce phishing risk because they do not rely on a shared password that a user can type into a fake website. But they do not remove the need to secure the device.

If malware is already running on a corporate computer, it can look for sessions, tokens, local keys, browser data and other elements involved in real-world authentication.

For business teams, the takeaway is clear: strong authentication is not enough if the endpoint is already under attacker control.

Where the Risk Is for Organizations

The highest-risk devices are those that combine several factors:

• Chrome and synced passkeys are used;
• the device has access to critical business accounts;
• active browser sessions are stored;
• malicious browser or endpoint activity is not visible;
• personal and corporate accounts use the same browser profile;
• the device belongs to an administrator, developer, finance employee or executive.

On these devices, local compromise may turn into access to cloud services, internal systems or sensitive accounts.

What Should Be Checked

For organizations, the practical review is not whether passkeys are “unsafe.” They remain an important and strong security mechanism.

The more important question is whether the devices using passkeys are sufficiently protected and monitored.

Security teams should review:

• which corporate devices use synced passkeys;
• which critical accounts rely on browser-based passkey login;
• whether relying parties require and validate user verification;
• whether there is visibility into malicious browser activity;
• whether token, session and local key theft is monitored;
• whether there is a response process for compromised devices.

The main takeaway is practical: passkeys improve phishing resistance, but they do not replace endpoint protection.

DIAMATIX Perspective

This topic shows why identity security and endpoint security need to be treated together.

DIAMATIX treats cases like this as trusted-device risk: if the browser, profile or local environment is compromised, even strong authentication mechanisms can be abused through the implementation layer.

For SOC (Security Operations Center) and MDR (Managed Detection and Response), this means connecting signals from endpoints, browsers, accounts, cloud logins and unusual sessions.

CISO Analysis

For CISOs, the key question is whether the organization treats devices with access to critical accounts as part of identity security.

Key questions to review:

• Which accounts use passkeys, and on which devices?
• Are passkeys synchronized through a browser password manager?
• Do we have visibility into compromised browser profiles?
• Do we monitor unusual logins after an endpoint incident?
• What do we do if a device holding passkeys is infected?
• Do we apply stricter rules for administrators, developers and executives?

The practical takeaway: passkeys are a strong step forward, but they need endpoint control, monitoring and fast response when compromise occurs.

Check whether your account security also covers the device

DIAMATIX can help review identity risk, endpoint visibility, browser sessions, passkey usage and response readiness for compromised devices.

Request an identity and endpoint risk review with DIAMATIX.
Trusted · Innovative · Vigilant

Sources

• Unit 42. Google Cloud Authenticator: The Hidden Mechanisms of Passwordless Authentication.
• The Hacker News. Google Password Manager Attacks Could Let Malware Hijack Passkey-Protected Accounts.
• Chromium public source references cited in public reporting.
• NVD search status as cited in public reporting.

This article is based on publicly available information as of August 2026.