421/69 Wednesday, August 5, 2026
Cybersecurity researchers have discovered a new attack technique called Pass-ta-key, which targets Google Password Manager in the Chrome browser on Windows systems using TPM chips. The attack affects devices that are already infected with malware and could allow threat actors to take over accounts, bypass authentication processes, and extract passkey private keys. Although passkeys are widely regarded as a more secure authentication method than traditional passwords because they can effectively prevent phishing attacks, this incident shows that risks remain if the device environment itself is not secure and malware is present.
The attack is divided into three levels. The first is the basic Pass-ta-key technique, in which malware impersonates a trusted device to submit account access requests. The next level is Silver Pass-ta-key, where attackers can register their own authentication key in the system to bypass verification. The most severe level is Golden Pass-ta-key, where malware can extract the master key from the browser’s memory and use it to decrypt all passkeys synced to the account. In terms of platform-side protection, services with strict authentication state validation, such as GitHub, can prevent the basic-level attack. If authentication fails, the system displays a warning that the user cannot sign in with a passkey and recommends using a password instead. Meanwhile, services such as eBay, which were previously found to have weaknesses in this validation process, have reportedly fixed the issue after being notified by the researchers.
To reduce risk, users and administrators should prioritize endpoint security by installing and regularly updating anti-malware protection, as these attacks can only work when malware is already running on the user’s device. In addition, website developers and identity management system providers should carefully validate user authentication processes, strengthen controls for registering new devices, and improve systems to prevent sensitive data from remaining in memory. Users should also regularly review account access history. If abnormal passkey activity is detected, they should consider changing the sign-in method and immediately check the security of the device to prevent potential damage.