Passkeys Can Be Hijacked Without Ever Touching Your Fingerprint

Passkeys are generally treated as the answer to stolen passwords. In August 2026, Unit 42 at Palo Alto Networks published three techniques it named Pass-ta-key, and the result is not reassuring. Malware already running on your Windows PC can use your passkey synced through Google Password Manager to sign in to your account. No fingerprint. No device unlock. No consent prompt on screen.

The position needs stating up front. None of these techniques decrypt or break passkey cryptography. The cryptography is intact. What gets attacked is the layer around it.

Three techniques, escalating

Unit 42 grouped its findings into one family, with names that get steadily more devastating. Pass-ta-key blends the word passkey with the phrase "pass the key", with a nod to a "plate of pasta" for how tangled the key implementation can get.

• Pass-ta-key — malware reads Chrome's TPM-backed device identity key out of a local file, then asks the same TPM to sign its own request through the standard Windows cryptography APIs. The result is a valid login assertion. The User Verified flag comes back false, so strict sites like GitHub reject it. But Unit 42 confirmed that other platforms, eBay among them, initially accepted the login without checking the flag. eBay has since patched it after responsible disclosure.
• Silver Pass-ta-key — malware deletes or corrupts the local passkey state file, forcing Chrome to re-onboard. During that window the cloud authenticator accepts a newly registered user verification key belonging to the attacker without checking that it came from secure hardware. Assertions signed with that key carry a legitimate UV flag, so the attacker can sign in from their own machine, repeatedly, without ever touching your device again.
• Golden Pass-ta-key — this is the worst one. Malware triggers re-onboarding, then reads a 32-byte security domain secret out of Chrome's process memory while it briefly sits there in plaintext. That secret is the master key protecting every one of your synced passkeys. An attacker can decrypt all of them, including the ones you have not created yet.

Here is what makes Golden the most damaging: Google Password Manager has no rotation or revocation mechanism for that secret. If it leaks, the damage cannot be undone by changing your passwords.

Two things to be clear about before panicking

First, all three are post-compromise attacks. Every one of them assumes malware is already running on your machine as the logged-in user. This is not a remote attack you can pick up by visiting a site. Second, the scope is narrow. The research covers Chrome with Google Password Manager on Windows machines that have a TPM. The WebAuthn and FIDO2 standards themselves are untouched.

But both limits fail to blunt the point. The promise of a passkey is that stealing it should be much harder than stealing a password. These techniques narrow that gap on a machine that is already infected. On 7 May 2026, the FIDO Alliance reported roughly 5 billion passkeys in use, with 75 percent of survey respondents having enabled at least one.

That second number is the important part of this story. If billions of passkeys are now synced across devices, then one compromised device sets the scope for every account you own. A cloud-synced passkey inherits the security of the weakest device it syncs to.

Why there is no CVE

One detail rarely gets reported. A search of the National Vulnerability Database on 3 August 2026 found no CVE matching any of the three techniques. Arie Olshtein, a senior staff security researcher at Palo Alto Networks, explained why to the Guardian: Google rarely assigns CVEs to issues that require the device to already be compromised by malware.

So do not go looking for a CVE number to patch. What needs patching is how you respond when a device really has been breached.

What to do after your device is breached

The most commonly recommended advice is also the most serious one. Treat any infostealer infection as a full credential reset event, and that now includes passkeys.

• Rebuild the machine. A partial clean is not enough, because what you are left with is the compromised machine
• Re-register your passkeys from a clean device. Do not rely on a device that was breached
• Stop treating the biometric prompt as proof of a human. This is the core of Pass-ta-key: a valid assertion appears without a prompt ever reaching your screen. If there is no prompt, there is nothing for you to verify
• Check that the sites you use actually validate the User Verified flag. Silver Pass-ta-key succeeds partly because some of them do not, and the ones that do will refuse the login

What actually changed

Passkeys remain the most phishing-resistant option available. Research like this does not change that. What changes is how honestly we assess risk.

The way of thinking has been "passkeys are solved, moving on". This work shows that the attacked layer is not the cryptography but storage, sync, and recovery. That layer is real, and it belongs to the identity provider rather than to you.

So the honest answer is not that passkeys are useless. It is this: passkeys are very good, and the device holding them still needs protecting like any other. If that device is already breached, everything on it should be treated as lost.

Check the passwords you are still using now. Open Password Strength Checker on Loonix to see which patterns a password actually gives away, and change the weak ones. And where a site supports passkeys, use one.