New “Pass‑ta‑key” Attacks Let Malware Hijack Google‑Synced Passkeys on Windows PCs
What Happened — Researchers from Palo Alto Networks’ Unit 42 disclosed three novel techniques that let malware already present on a Windows device abuse Google Password Manager’s synced passkeys. By leveraging the TPM‑backed device identity key, the malware can request authentication assertions from Google’s cloud authenticator without user interaction, and in one variant can even register its own verification key.
Why It Matters for Compliance & Audit Readiness
- The attacks bypass the “something you know/are” factor that SOC 2 CC6.1 (Logical Access) expects to protect credential‑based access to SaaS services.
- Continuous monitoring of endpoint security and privileged‑access controls is required to evidence that only authorized, trusted devices can request authentication tokens.
- Demonstrates the need for documented verification of the User Verified flag in downstream services—a control gap that can be closed with policy enforcement and audit‑ready logging.
Who Is Affected – Enterprises across all sectors that rely on Google Password Manager for passkey sync, especially those with Windows workstations using TPM (e.g., tech SaaS, finance, healthcare, education).
Recommended Actions
- Map the attack path to SOC 2 CC6.1 and CC6.2 controls; ensure your access‑control policy mandates verification of the User Verified flag on every authentication request.
- Deploy endpoint‑detection‑and‑response (EDR) solutions that can flag abnormal use of Chrome’s TPM‑backed device identity APIs.
- Conduct a credential‑access risk assessment and update your incident‑response playbook to include passkey‑theft scenarios.
Source: BleepingComputer
Technical Notes – The techniques exploit Chrome’s handling of TPM‑backed device identity keys and Google’s cloud authenticator onboarding flow. No CVE is associated; the weakness is in the design of the device‑trust handshake. Affected data includes private passkey material stored in Google’s cloud sync.