Passtakey attacks let malware hijack Google synced passkeys

Security researchers have discovered a series of attacks that can allow malware on a compromised Windows computer to hijack Google's synced passkeys, potentially giving attackers access to a user's online accounts without triggering standard biometric or PIN verification. The findings, published on August 4, 2026, by Palo Alto Networks' Unit 42, highlight significant implementation flaws in Google's cloud-based passkey system, though they do not break the underlying cryptographic security of passkeys themselves.

The three attack methods, collectively named "Passtakey," all require that malware is already present and running on a victim's Windows device equipped with a Trusted Platform Module. The research specifically targets Google Password Manager within the Chrome browser. The first technique, dubbed Passtakey, allows malware to impersonate a trusted device by using Chrome's hardware-backed identity key to generate a valid login assertion for a passkey-protected account. This process can occur without any user interaction. However, its success depends on whether the website being accessed properly checks a "User Verified" flag that indicates whether biometric or PIN...