Malware Can Bypass Chrome’s Google Password Manager Passkeys, Hijacking User Accounts
What Happened – Unit 42 identified three malware‑driven attack paths—“Pass‑ta‑key,” “Silver Pass‑ta‑key,” and “Golden Pass‑ta‑key”—that let a malicious program running under a normal Windows user account sign into Chrome‑saved, passkey‑protected services without any user interaction (no fingerprint, PIN, or UI prompt).
Why It Matters for Compliance & Audit Readiness
- Demonstrates a gap in SOC 2 Access Controls: credential‑based authentication can be subverted by local malware, undermining the “Logical Access” criteria.
- Continuous‑monitoring evidence (process logs, endpoint telemetry) is needed to prove that only authorized, uncompromised devices can access privileged accounts.
- Highlights the importance of Security Awareness Training and endpoint hardening as part of the “Security” principle’s control set.
Who Is Affected – SaaS providers, enterprises, and any organization that relies on Google Password Manager or Chrome’s built‑in passkey feature for employee or customer authentication (tech, finance, healthcare, etc.).
Recommended Actions
- Map the scenario to SOC 2 CC6.1 (Logical Access) and CC6.2 (Least Privilege) controls; document how you detect and respond to anomalous credential use.
- Deploy endpoint detection & response (EDR) to flag unauthorized access to the password manager’s credential store.
- Enforce multi‑factor authentication that includes a hardware‑based factor (e.g., FIDO2 security key) for high‑risk accounts.
- Refresh security‑awareness training to cover the risk of “password‑manager hijacking” malware.
Source: The Hacker News
Technical Notes
- Attack vectors: malicious Windows binaries leveraging Chrome’s local “Google Password Manager” API to retrieve the master key and generate valid passkey assertions.
- No public CVE; the weakness lies in the client‑side handling of the master key rather than a server‑side flaw.
- Affected data: authentication tokens for any service that supports WebAuthn passkeys stored in Chrome.
Source: Unit 42 research brief (linked above)