MalwareBleeping Computer
9.0 — CRITICAL
New Pass-ta-key attacks let malware hijack Google-synced passkeys
Security researchers have discovered three attacks that allow malware on already-compromised Windows devices to abuse Google Password Manager's synced passkeys to take over accounts, bypass user verification, and extract passkey private keys. [...]
🤖 AI BriefingAuto-generated threat analysis
🔍Threat Overview
Malware on compromised Windows devices can hijack Google-synced passkeys, bypass user verification, and extract private keys using novel attacks called Pass-ta-key, Silver Pass-ta-key, and Golden Pass-ta-key.
⚙️Technical Details
Affected Systems
Windows devices
Attack Vectors
Pass-ta-key: impersonate a trusted device and request authentication responseSilver Pass-ta-key: register own user-verification key with Google's cloud authenticatorGolden Pass-ta-key: obtain master key used to encrypt synced passkeys
💥Impact Assessment
Severity: critical
Who Is at Risk
users of Google Password Manager on Windows devicesSeverity: critical
🛡️Recommended Actions
1Validate user verification
2Harden recovery and device re-registration processes
3Prevent master keys from becoming accessible in browser memory
📦Affected Products
Google Password ManagerChrome
Read the full article
This is a curated summary. The complete article is available at Bleeping Computer.