Unit 42 Finds 'Pass the Passkey' Flaws in Google's Synced Ecosystem
New research shows malware can extract synced passkey private keys and bypass user verification on compromised endpoints.
Security researchers from Palo Alto Networks' Unit 42 have identified new attack classes targeting passwordless authentication, specifically within Google's synced passkey ecosystem. The findings demonstrate that the very mechanisms designed to make passwordless logins convenient can be weaponized by malware to achieve total account takeover.
According to Unit 42, attackers can leverage a compromised endpoint to misuse onboarding, recovery, and device trust workflows. This allows an adversary to authenticate into accounts without any user interaction and bypass standard user verification requirements. Most critically, the researchers proved that malware on a compromised device can extract all synced passkey private keys from the Cloud Authenticator used by desktop clients.
The Shift Toward Syncing
Passkeys were originally designed to replace traditional passwords by utilizing public-key cryptography, a move intended to eliminate the risks of phishing and credential stuffing. While early FIDO2 security keys were strictly hardware-bound—meaning the key never left the physical device—providers like Google introduced "synced passkeys." This evolution allows keys to be available across multiple devices via a cloud vault, prioritizing user experience and recovery over the rigid isolation of hardware tokens.
A Trade-off Between Ease and Security
This research highlights a fundamental tension between convenience and security. While passkeys effectively solve the problem of remote phishing, the "Pass the Passkey" attack reveals that cloud-syncing creates a centralized point of failure. If a user's endpoint is compromised, the syncing mechanism can be exploited to grant an attacker full access to the vault. This potentially makes synced passkeys as vulnerable to local malware as traditional password managers, undermining the perceived security leap over passwords.
The Path Forward
As the industry moves toward a passwordless future, the Unit 42 findings suggest that device trust and the security of the cloud authenticator remain critical weak points. The industry must now determine if the risks associated with synced keys can be mitigated without returning to the inconvenience of non-syncing hardware keys. For now, the research serves as a warning that endpoint security remains the primary line of defense, regardless of the authentication method used.