Pass-ta-key Attack: How Malware Can Hijack Your Google-Synced Passkeys

What Is the Pass-ta-key Attack and Why Does It Matter?

A newly identified class of attack — dubbed "Pass-ta-key" by security researchers — has revealed a significant vulnerability in the way Google synchronises passkeys across devices. The passkey security attack technique allows malware already present on a device to extract and abuse Google-synced passkeys, effectively defeating one of the most celebrated advances in modern authentication. For developers, IT administrators, and privacy professionals who have been championing passkeys as a phishing-resistant replacement for passwords, this is a sobering development that demands immediate attention.

Passkeys were designed from the ground up to be unforgeable and device-bound, built on the FIDO2/WebAuthn standard and endorsed by the FIDO Alliance, Google, Apple, and Microsoft as the future of secure login. The promise was simple: because passkeys are cryptographic key pairs that never leave the device, they cannot be phished or stolen from a server breach. The Pass-ta-key attack challenges that promise in a meaningful way — specifically by targeting the cloud sync layer that makes passkeys convenient for everyday users.

According to the original disclosure on BleepingComputer, the attack exploits the mechanism by which Google Password Manager synchronises passkeys to the cloud, allowing an attacker with local malware access to intercept or export these credentials before they can be used for authentication. The implications stretch far beyond individual users: enterprise environments, small businesses, and any organisation relying on Google's ecosystem for identity management are potentially exposed.

How Pass-ta-key Exploits the Gap Between Convenience and Security

To understand the attack, it helps to understand how Google-synced passkeys work. When a user creates a passkey on one device — say, an Android phone — Google Password Manager encrypts and uploads it to Google's cloud infrastructure, so the same passkey becomes available across all devices signed into the same Google account. This cross-device availability is the feature that drove mainstream adoption, removing the friction of device-specific keys.

The Pass-ta-key attack targets precisely this synchronisation pipeline. If malware gains a foothold on a victim's device — through a phishing email, a malicious download, or an unpatched vulnerability — it can interact with the local credential storage or the sync process in a way that extracts or clones the passkey material. Because the passkey is synced to the cloud, the attacker does not need to maintain persistent access to the original device. Once the key material is exfiltrated, authentication can be performed from an entirely different device under attacker control.

Research from the FIDO Alliance has consistently emphasised that passkeys derive their security strength from being bound to authenticators, with private keys never being exposed. The Pass-ta-key attack does not break the cryptographic foundation of FIDO2 itself — rather, it attacks the implementation layer, specifically the way vendors like Google have chosen to balance security with cross-device usability. This is a distinction with enormous practical consequences: the underlying standard remains sound, but the deployment choices introduce exploitable weaknesses.

Security researchers have noted a troubling pattern in endpoint detection: according to data cited by Picus Security, security teams log only 54% of successful attacks and generate alerts on just 14% of them. The vast majority of malicious activity — including the kind of local access that enables a Pass-ta-key attack — moves through enterprise environments completely unseen. This detection gap makes the threat particularly acute for organisations that assume their EDR and SIEM tools would catch credential theft in progress.

Why the Timing of This Passkey Security Attack Is Especially Significant

The Pass-ta-key disclosure arrives at a particularly sensitive moment in the trajectory of passwordless authentication. Major platforms have been aggressively pushing passkey adoption: Google has enabled passkeys by default for personal accounts, Apple has integrated passkeys deeply into iCloud Keychain, and Microsoft has rolled out passkey support across its identity platform. According to the W3C WebAuthn Level 3 specification, the standard underpinning passkeys was explicitly designed to prevent credential theft and replay attacks.

For enterprise IT decision-makers who have been building roadmaps around passwordless authentication — particularly those in regulated industries subject to GDPR or NIS2 compliance requirements — the Pass-ta-key finding introduces a new risk factor that must be evaluated. Cloud-synced passkeys, while dramatically more resistant to classic phishing than passwords, are not immune to attack when the endpoint itself is compromised.

The contrast with hardware security keys is instructive. A physical FIDO2 key — such as a YubiKey — stores cryptographic material on tamper-resistant hardware that cannot be exported, even by malware with administrator privileges on the host machine. Cloud-synced passkeys make a deliberate trade-off: they sacrifice some of that hardware-enforced guarantee in exchange for cross-device accessibility. The Pass-ta-key attack is, in essence, the price of that trade-off becoming visible.

What This Means for Enterprise Security Teams and IT Administrators

For IT administrators and security professionals managing enterprise environments, the Pass-ta-key attack reinforces a principle that is sometimes overlooked in the rush to adopt modern authentication: endpoint security is not separable from credential security. If the device is compromised, the credentials on that device — however sophisticated — are at risk. This is not a new insight, but the specific mechanics of cloud-synced passkey exfiltration give it a fresh urgency.

According to guidance from the European Union Agency for Cybersecurity (ENISA), multi-layered authentication strategies remain the most effective defence against credential compromise. ENISA's recommendations align with what this research reinforces: no single authentication mechanism should be treated as a silver bullet, and defence-in-depth remains essential even when deploying phishing-resistant credentials.

Practically speaking, enterprise teams should consider several immediate steps. First, audit which user accounts are relying on cloud-synced passkeys versus device-bound passkeys or hardware tokens. For high-privilege accounts — administrators, finance personnel, executives — the use of hardware security keys rather than cloud-synced alternatives should be a firm policy requirement. Second, invest in endpoint detection capabilities that can identify the specific process behaviours associated with credential store access. The detection gap highlighted by Picus Security's research — where 86% of attack activity goes undetected — is not acceptable when the stakes include authentication bypass.

Third, organisations subject to GDPR or operating under NIS2 obligations should review whether a passkey compromise of this nature would trigger a reportable incident under their existing data breach notification frameworks. Depending on the data accessible behind the compromised authentication, the answer may well be yes — and incident response plans should be updated accordingly.