Security researchers have discovered three new attack methods that allow malware on Windows PCs to hijack Google synced passkeys [1].
These findings challenge the assumption that passkeys provide absolute protection against account takeover. While passkeys are designed to be phishing-resistant, these techniques show that once a device is compromised, the security benefits of the FIDO2 standard can be undermined without breaking the underlying cryptography [4].
Researchers from Palo Alto Networks Unit 42 disclosed the research last week [1]. The attacks target Windows devices using Google Password Manager’s cloud-synced passkeys. By abusing Windows logs and Windows Hello, malware can recover synced private keys or bypass multi-factor authentication (MFA) [1].
One specific vulnerability involves the Chrome browser. Researchers said that a 32-byte master key is leaked into the system memory [5]. This leak allows attackers to access encrypted data that would otherwise be protected by the browser's security layers.
Because the attacks occur after a device is already infected, the malware operates with the permissions of the user. This allows the attacker to bypass biometric or PIN verification required by Windows Hello [4]. The researchers said that this post-compromise access enables the theft of credentials that were previously thought to be inaccessible to software-based malware [1].
The disclosed methods do not involve a flaw in the FIDO2 protocol itself. Instead, they exploit the way operating systems and browsers handle the storage, and synchronization, of keys [1]. This means the risk is tied to the implementation of the sync feature rather than the cryptographic standard used to generate the passkeys [2].
Users on Windows PCs who rely on Google's cloud synchronization for their passkeys are the primary targets of these methods [2]. The research highlights a critical gap in how private keys are shielded from high-privilege malware on a local machine [3].
“Malware on Windows PCs can recover synced private keys or bypass phishing-resistant MFA.”
This discovery shifts the security conversation from external phishing to internal device integrity. While passkeys effectively eliminate the risk of remote credential theft via fake websites, they cannot protect a user if the endpoint is already compromised. The ability to extract a master key from memory suggests that software-based synchronization creates a larger attack surface than hardware-bound security keys, which keep private keys isolated from the operating system entirely.
