# Passkey authentication security concerns – new variants

> Live situation record from CLSTR: https://clstr.news/situations/passkey-authentication-security-concerns
> Updated: 2026-08-06T00:02:31.000Z. Sources: 8. Developments: 2.

In early August 2026, Japanese fintech MoneySquare announced a rollout of passkey authentication for customer logins, following guidance from Japan’s Financial Services Agency and the Japan Securities Association. At the same time, Palo Alto Networks’ Unit 42 warned that a newly discovered “Pass‑ta‑key” attack could bypass passkey logins by exploiting Google Password Manager on Windows PCs already compromised by malware.

Two days later Unit 42 released a technical briefing describing several variants of the technique. The original Pass‑ta‑key uses the device‑identity key to generate a WebAuthn assertion without the user‑verification flag. A “Silver Pass‑ta‑key” forces Chrome to re‑onboard the device, allowing forged assertions that appear to have passed Windows Hello verification. The “Golden Pass‑ta‑key” extracts the 32‑byte Security Domain Secret (SDS) from Chrome’s diagnostic logs, giving attackers portable private‑key material and enabling authentication without biometric checks. Google subsequently removed the SDS from those logs, and services such as eBay have updated their implementations to require proper user verification.

Unit 42 also reported a related “Vaultjacking” technique described by Japanese firm PhishU, which obtains a Google Password Manager PIN via phishing, joins the security domain, and decrypts all synced passkeys and passwords. The researchers reiterated that while passkeys are safer than passwords, they remain vulnerable on infected host devices, urging users to keep operating systems and browsers up to date and service providers to add additional verification steps.

## Claims

- Unit 42 identified three attack variants—Pass‑ta‑key, Silver Pass‑ta‑key and Golden Pass‑ta‑key—targeting Google Password Manager synced passkeys on Windows. (corroborated by 2 sources)
- All three attacks require malware already present on the victim's Windows PC. (corroborated by 2 sources)
- Golden Pass‑ta‑key extracts the 32‑byte Security Domain Secret (SDS) from Chrome diagnostic logs, enabling extraction of private key material. (corroborated by 2 sources)
- Pass‑ta‑key exploits the device‑identity key to generate a WebAuthn authentication assertion without the user‑verification flag. (single source)
- Silver Pass‑ta‑key forces Chrome to re‑onboard the device and register a new key, allowing the attacker to produce assertions with the user‑verification flag set. (single source)
- eBay initially accepted the forged assertion but later changed its implementation to validate the user‑verification flag. (single source)
- Google removed the SDS value from Chrome’s FIDO diagnostic logs after the Unit 42 report. (single source)
- The “Vaultjacking” technique described by PhishU obtains a Google Password Manager PIN via phishing to access all synced passkeys and passwords. (single source)

## Timeline

### 2026-08-06: Unit 42 uncovers new attacks on Google Password Manager passkeys

Unit 42 discovered three Windows‑based attacks on Google Password Manager’s synced passkeys, exploiting device‑identity keys, Chrome onboarding, and the Security Domain Secret. Google patched log exposure; eBay

5 sources. https://clstr.news/cluster/new-passkey-attack-targets-google-password-manager-on-infected-windows-pcs

### 2026-08-04: MoneySquare launches passkey login as security firms warn of Google Password Manager exploits

MoneySquare will roll out passkey login in Japan in August 2026, while researchers disclosed a “Pass‑ta‑key” attack that can bypass Google Password Manager’s passkey authentication, prompting Google to issue a‑

3 sources. https://clstr.news/cluster/moneysquare-launches-passkey-login-as-security-firms-warn-of-google-password-manager-exploits

---
Cite as: Passkey authentication security concerns – new variants. CLSTR, https://clstr.news/situations/passkey-authentication-security-concerns