Google Passkeys Can Be Hacked Without Fingerprint Or PIN, Researchers Warn
Unit 42 researchers have discovered three ways malware can silently access Google Passkeys on infected Windows computers, without needing fingerprints, face scans, or PINs.
Published : August 4, 2026 at 6:41 PM IST
Hyderabad: Cybersecurity researchers have discovered that passkeys saved in Google Password Manager can be accessed by malware on infected Windows computers, without requiring fingerprints, face scans or PINs, the security checks typically needed to unlock a passkey. The finding raises fresh questions about the safety of passkeys, which have increasingly replaced traditional passwords as a more convenient and, until now, more secure way of logging in.
Unit 42, a cybersecurity team at Palo Alto Networks conducted this research, which identified three distinct attack methods, collectively named Pass-ta-key. These comprise three escalating levels of severity, including Pass-ta-key, Silver Pass-ta-key, and Golden Pass-ta-key, with each successive method proving more dangerous than the previous one.
Crucially, all three attacks depend on malware already being present and running on the victim's computer. None of the methods allow a hacker to remotely break into an account from a distance without first infecting the device. Researchers were also careful to note that as things stand there is no evidence of these methods being used in real-world attacks. The research is intended as a warning about a potential weakness, rather than proof of an active threat.
How passkeys work, and where the vulnerability lies?
To understand the attacks, one must know how a passkey works. A passkey replaces a traditional password with a key pair. The website a person logs into holds a public key, while the matching private key is stored securely on the user's own device or within Google's system. When someone attempts to log in, the website sends a "challenge" that must be signed using the private key before access is granted. This process is what makes passkeys resistant to phishing, since a fake website has no way of tricking a user into handing over their private key.
Problems begin to emerge when passkeys are synced across multiple devices, such as a phone, laptop and tablet all sharing the same account. To make this syncing possible, Google generates a master key known as the Security Domain Secret (SDS). This is a 32-byte code responsible for encrypting the private keys of every passkey linked to that account.
On Windows computers specifically, Chrome also creates two further keys, which are a device identity key and a user verification key. Both keys are meant to be protected by the computer's Trusted Platform Module (TPM) chip, a dedicated security component. Despite this protection, researchers found that malware can still find ways to exploit these keys.
Pass-ta-keys levels explained
The first and least severe method called Pass-ta-key exploits the device identity key stored in a computer's TPM chip. Although the key is meant to be secure, Chrome handles it in a way that allows malware to extract it and use it to sign in on the attacker's behalf. Google's cloud system accepts this login as genuine.
This method does have a limitation. As it lacks a "user-verified" mark, websites that carry out proper verification checks are able to reject it. During testing, GitHub successfully detected and rejected the attempted login. On the other hand, eBay initially accepted it, though the company fixed the underlying flaw after being alerted to it by Unit 42.
The second method, Silver Pass-ta-key, is considerably more advanced. Here, the malware forces the victim's device to re-register itself, and in the process inserts a fake verification key that it has created. Google's system accepts this fake key and marks the user as verified. From that point onwards, the hacker no longer needs repeated access to the victim's computer at all; they can simply log in from their own device whenever they choose.
The third and most dangerous method, Golden Pass-ta-key, goes a step further. Instead of working around the verification system, the attacker attempts to steal the master SDS itself. Researchers discovered that this master SDS had previously been stored in Chrome's log files in plain, unencrypted text. Although Google has since fixed that particular issue, the SDS still briefly remains in the browser's memory during the device recovery process, leaving a narrow window in which malware can extract it.
Once a hacker obtains this master key, the consequences are serious. They can decrypt every single passkey linked to that account, without needing any further access to either Google's systems or the victim's own computer.
Researchers went as far as demonstrating this attack on a cryptocurrency exchange to illustrate the real-world risk. Perhaps most concerning of all, Google currently has no way for a user to change or revoke this master SDS once it has been compromised, unlike a password, which can simply be reset.
What users should do?
Researchers were clear that simply changing a password manager's PIN will not help, since doing so does not alter the underlying master secret. If someone suspects their passkey has been compromised, the recommended course of action is to delete the passkeys from all important accounts, generate new ones, and thoroughly wipe the affected computer to remove any lingering malware.
Despite these findings, researchers were keen to stress that passkeys still offer strong, genuine protection against phishing attempts, password theft and large-scale data leaks. The vulnerabilities identified in this research relate specifically to the systems built around passkeys, namely device syncing, registration and cloud-based recovery, rather than any flaw in the core idea of the passkey itself. In other words, removing the traditional password was a meaningful step forward for security, but this research shows that the supporting infrastructure around it still needs careful attention.
