Passkeys are supposed to be the fix for stolen passwords. New research from Palo Alto Networks' Unit 42 shows they can still be taken — not by breaking the cryptography, but by attacking everything built around it. The team disclosed three techniques, named Pass-ta-key, Silver Pass-ta-key, and Golden Pass-ta-key, that let malware already running on a Windows PC hijack passkeys synced through Google Password Manager in Chrome.
A passkey is a login credential stored on your device that replaces a password. You approve a sign-in with a fingerprint, face scan, or device PIN, and the secret itself never leaves your hardware. That design is why passkeys resist phishing. The Unit 42 work does not undo any of that math.
How the three Pass-ta-key attacks work
Each technique is a step more damaging than the last, according to Unit 42's research write-up.
| Technique | What it does | Worst outcome |
|---|
| Pass-ta-key | Impersonates a trusted device using Chrome's TPM-backed identity key | Gets a valid sign-in response with no fingerprint, face check, or device unlock |
| Silver Pass-ta-key | Forces device re-registration and enrols the attacker's own user-verification key | Attacker can sign in from their own machine |
| Golden Pass-ta-key | Reads the 32-byte security domain secret out of Chrome's memory during re-registration | Decrypts every synced passkey on the account |
The TPM (Trusted Platform Module) is the small security chip in modern PCs that stores keys and vouches that a device is genuine. The security domain secret is the master key that unlocks the passkeys Google syncs between your devices. Pulling that one value out of memory, as the Golden variant does, is the difference between losing one login and losing all of them.
What the attacks do not break
Two limits matter before anyone panics.
First, the attacks all assume malware is already running on the machine as the logged-in user. This is not a remote attack you can catch by visiting a bad website. Something has to be on the PC first.
Second, the research only covers Windows machines with a TPM, running Chrome with Google Password Manager. It does not touch WebAuthn, the underlying standard, and it does not mean passkeys are broken as a concept. The weak points are the local files, the device-trust signals, the enrolment process, and the account recovery paths that sit around the keys.
That is still a meaningful finding, because the whole promise of a passkey is that stealing it should be much harder than stealing a password. These techniques narrow that gap on an already-infected machine.
What Google has fixed
Google applied fixes after the private disclosure, including removing the security domain secret from Chrome's FIDO logs after researchers flagged it. At least one large service, eBay, patched on its own side as well. As of August 3, a search of the National Vulnerability Database turned up no CVE identifier matching any of the three named techniques, so there is no single tracking number to follow.
Unit 42's recommendations are aimed mostly at the industry rather than at end users: websites should require and properly check the user-verification flag on sign-ins, and credential managers should validate newly registered device keys, harden their recovery flows, and stop leaving master keys sitting in browser memory.
Why this lands harder on Philippine banking apps
The timing is awkward for Philippine finance. Under Bangko Sentral ng Pilipinas Circular No. 1213, banks and e-wallet operators averaging more than ₱75 million in monthly online transactions had to stop using SMS and email one-time passwords for high-risk transactions from June 25, 2026. The replacements the BSP points to are biometric, behavioural, or passwordless methods — which in practice means FIDO-based passkeys.
BSP Deputy Governor Lyn Javier framed the rule as balancing innovation against fraud: "The BSP is equally dedicated to promoting innovation in financial services as to protecting customers from new forms of fraud."
So Filipino bank and e-wallet users are being moved onto passkeys by regulation, right as research shows the sync layer around them has soft spots on infected Windows PCs. The practical takeaway is not to avoid passkeys — they are still far better than an SMS OTP, which can be intercepted or socially engineered out of you. It is that endpoint hygiene still decides everything. A passkey on a clean device is strong; a passkey on a machine running an infostealer is a different conversation.
If you have moved your bank logins to passkeys, the useful habits are unchanged: install apps only from official stores, keep Chrome and Windows updated, and treat cracked software and "free" installers as the most likely way malware reaches your PC in the first place. If you want a refresher on how Google's own account recovery is shifting, see our earlier explainer on Google's selfie video sign-in option.
