Unit 42 shows how synced passkeys can be taken from a compromised device

Unit 42 at Palo Alto Networks described three attacks on 3 August 2026 against synced passkeys in Google Password Manager, as they are used in Chrome on Windows machines with a TPM chip. Malware already running as the user can enumerate synced credentials and abuse the trust the device holds in order to request valid authentication assertions. Further techniques can register a verification credential the attacker controls, or recover the secret that encrypts the synced passkeys and thereby reach the private key material itself. Unit 42 stresses that the research does not break the cryptography behind passkeys, and that every attack assumes the machine is already compromised. The findings were reported to Google and to the affected services, and eBay corrected a weakness in user verification validation that was found during the testing.

What happens technically

A passkey is a key pair. The public part sits with the service, the private part sits with the user, and login happens when the private key signs a challenge from the service. There is no password, and therefore nothing to trick out of the user on a fake page. When the keys are synced between the user's devices they still have to be stored encrypted somewhere, and they have to be usable by the browser on the machine.

That is the space the attacks exploit. According to Unit 42, malware running with the user's rights can request valid authentication assertions by abusing the trust the device already holds, without touching the cryptography. A second technique registers a verification credential the attacker controls, meaning a new approved link in the chain. The third recovers the secret protecting the synced passkeys, and the private key material can then be extracted. The distinction is worth holding on to. Passkeys still stand up to phishing, which is what they were built for. They do not stand alone against a machine that has already been taken over, and that is an entirely different threat from a fake login page.

What this means for you as you roll out passkeys

If you are rolling out passkeys, our view is that you are heading in the right direction, and this case does not change that direction. It adjusts the expectation. Passkeys move the risk from the login page to the device. The state of the machine is therefore the decisive control, not an afterthought to your identity project.

The practical question you are left with is where the passkeys live. Keys bound to hardware and not synced do not carry the same exposure as keys synced between devices through a cloud service. For your high value accounts, meaning administrators, finance and management systems, our view is that you should make that choice deliberately and write it down. If your organisation is covered by NIS2, both access control and endpoint security sit under Article 21.

Berigo recommends

• Continue the rollout of passkeys, which still removes phishing as a route in.
• Consider hardware bound keys without syncing for administrator accounts and other high value accounts.
• Treat endpoint security as part of identity security, with current detection on the machines used to sign in.
• Follow updates from Google and from the services you use, since the findings were reported to them.
• Have a plan for what happens when a client is compromised, including which keys and sessions must then be revoked.