[CLSTR]
< Back to all clusters
[TECHNOLOGY] · 14 sources

started · updated

Part of situation: Software supply‑chain & AI attacks on dev ecosystems (34 clusters)

Google Passkey Security Flaw Exposes Accounts to Malware

Google Passkeys Unit 42 malware Chrome TPM

Security researchers at Palo Alto Networks’ Unit 42 disclosed three post‑compromise attack techniques—Pass‑ta‑key, Silver Pass‑ta‑key and Golden Pass‑ta‑key—that let malware on a compromised Windows PC hijack Google Password Manager passkeys. The methods do not break the underlying public‑key cryptography but exploit how Chrome stores and re‑enrolls device identity keys and how the Google Cloud Authenticator validates user verification. Pass‑ta‑key extracts Chrome’s wrapped TPM‑backed identity key to obtain a valid authentication assertion without any fingerprint, PIN or user prompt. Silver Pass‑ta‑key forces a re‑enrollment window to register an attacker‑controlled verification key, bypassing biometric checks. Golden Pass‑ta‑key steals the 32‑byte Security Domain Secret that encrypts all synced passkeys, enabling decryption of past and future credentials. The attacks require malware already present on the machine and affect Chrome on Windows systems equipped with a TPM. Some services, such as GitHub, correctly reject forged assertions, while others (e.g., eBay) were vulnerable until patched after disclosure. Google has been notified and is working on remediation, but no CVE identifiers have been assigned yet.

Entities

Chrome · Google · Google Chrome · Google LLC · Palo Alto Networks Unit 42 · Pillar Security · Trusted Platform Module · Unit 42 · Unit 42 (Palo Alto Networks)

Claims

What the coverage asserts, and how many sources carry each claim.

Sources

Google Deletes AI Agent Workflows After Prompt Injection Attack [bitnewsbot.com]
Passkeys : des chercheurs réussissent à contourner ses sécurités [android-mt.ouest-france.fr]
Google Chrome: Lücke hebelt Passkeys unter Windows aus [www.schmidtisblog.de]
Google pridal obnovu účtu cez selfie video: Ako funguje a kde ju zapnúť - MojAndroid. sk [www.mojandroid.sk]
A privilege escalation between two AI agents—not two human accounts [itnerd.blog]
Unit 42 Says Pass-ta-key Attacks Can Bypass Google Password Manager Passkeys [www.technobezz.com]
Tvoje passkeys v Chrome chráni jeden hlavný kľúč. Výskumníci ukázali, ako sa k nemu môže dostať hacker [vosveteit.zoznam.sk]
Kali365: Phishing usa login da Microsoft para invadir empresas | SempreUpdate [sempreupdate.com.br]
Ataques exploram falhas no Chrome para roubar passkeys armazenadas em contas da Google - Tek Notícias [tek.sapo.pt]
Le passkey di Google finiscono nel mirino con l’attacco “Pass-ta-key” [www.tuttoandroid.net]
Google Password Manager Flaw Allows Malware to Hijack Passkeys - Archyworldys [www.archyworldys.com]
Malware Can Steal Your Google Synced Passkey Without Asking for Your Password or Fingerprint [cybersecuritynews.com]
Google Password Manager Attacks Could Let Malware Hijack Passkey-Protected Accounts [thehackernews.com]
Google ADK Agent-to-Agent Attack: Privilege Boundary Breakdown Calling Privileged CI Workflows from Low-Privilege Triage Agents [dev.to]