Google Password Manager Attacks Could Let Malware Hijack Passkey-Protected Accounts

The attack, dubbed 'Pass-ta-key,' allows malicious software to steal synchronized passkeys without requiring a user's password or fingerprint. This revelation challenges the perception of passkeys as a secure alternative to traditional passwords. The following day, multiple outlets including Malwarebytes, SecurityWeek, and TechRadar published detailed analyses of the vulnerability. The reports underscore the potential for widespread exploitation, as passkeys are increasingly adopted as a more secure authentication method. Researchers have demonstrated that the attack can be executed without triggering any alerts or notifications, making it particularly insidious. Google has not yet issued an official response or patch for the vulnerability.

The security community is actively discussing the implications of this discovery. Experts are calling for immediate action from Google to address the issue and enhance the security of passkey management. Users are advised to remain vigilant and consider additional security measures until a fix is implemented. The vulnerability affects all devices that use Google Password Manager to sync passkeys. The attack method involves exploiting the synchronization process of passkeys across devices. Once a passkey is stolen, attackers can gain access to all accounts protected by that passkey.

This includes email, banking, and other sensitive services. The attack does not require physical access to the device, making it a significant threat to remote users. The discovery of the 'Pass-ta-key' attack highlights the ongoing challenges in securing passwordless authentication methods. As passkeys gain popularity, security researchers and developers must continue to innovate and adapt to emerging threats. Users should stay informed about the latest security developments and take proactive steps to protect their accounts.