Home / Blog / Authentication / What Pass-Ta-Key Tells Us About Passkeys 

What Pass-Ta-Key Tells Us About Passkeys 

In recent months there has been a lot of discourse around passwordless authentication and passkeys. This new discourse has been largely predicated on the fact that a password is something you know, which can be leaked by bad actors, while a passkey is something you have; it doesn’t give a website a shared secret that can be phished or reused through credential stuffing.

That removes several of the attack techniques associated with passwords. However, it doesn’t remove the endpoint, browser, credential manager or authentication service from the equation.

Recent research presented by Palo Alto Networks at DefCon 34 demonstrates that even passwordless authentication isn’t immune from exploitation. This research, dubbed as a ‘pass-ta-key’ attack, shows how malware already running on a compromised Windows endpoint can abuse Google’s synced passkey architecture to access passkey-protected accounts.

What is the Pass-Ta-Key Attack?

The pass-ta-key attack leverages the synced passkey features of Google Chrome to successfully gain access to passkey-authenticated services. Unit 42 identified three variants of the attack:

• Pass-ta-key: Malware already running on the victim’s device abuses the device’s hardware-backed identity key to request a valid passkey assertion from Google’s Cloud Authenticator.
• Silver pass-ta-key: This variant goes a step further by replacing the legitimate user-verification key with one controlled by the attacker. Once registered, the attacker-controlled key is treated as proof that the user unlocked the device, allowing the attacker to satisfy user-verification requirements and authenticate without needing the victim’s device during the later login attempt.
• Golden pass-ta-key: The attacker obtains the security domain secret used to protect synced passkeys, allowing them to recover and use private keys independently. Unit 42 describes this as affecting existing and future synced passkeys protected by the same secret.

How the Pass-Ta-Key Attack Works

It is worth noting that, like infostealer attacks discussed in previous research, this requires malware to be present on the given endpoint. The machine itself must be compromised in a method similar to other infostealer and RAT malware. 

While passkeys do often require a second factor (usually in the form of a PIN) in order to allow the user to manually approve an authentication request, the research revealed that this is not always verified. This verification step is not required to retrieve and authenticate using a given passkey; it simply sets a flag (a single bit in the data structure that is used to complete the authentication). As such, it is possible for an authenticating service to simply not check this flag, reducing the authentication flow to a single factor. 

W3 Authentication Definition

Researchers highlighted several services, such as eBay, were not checking the UV bit, and as such, did not utilize this other factor. This left these passkeys functionally equivalent to a simple session theft, like in the case of infostealer attacks. 

This vulnerability was raised by the researchers with the vendor in question, who patched the issue. This serves as a reminder that while passkeys are generally secure, they must be implemented securely. It’s up to the person implementing the standard to ensure all security checks are present and effective. 

What Does This Mean for Organizations?

Endpoint Security Becomes Crucial for Identity Security

Perhaps the clearest lesson from pass-ta-key is how closely endpoint security and identity security are becoming connected. While hardware-backed key storage substantially raises the bar for attackers, an attacker does not always need to extract the key.

If malware can persuade the legitimate device to perform a trusted operation on its behalf, the device itself becomes part of the attack path. That makes controls such as EDR, anti-malware, application control, browser hardening and rapid re-evaluation of device trust when the endpoint is compromised key to effective identity security.

Least privilege remains valuable too, particularly for limiting what malware can do after execution, but Pass-ta-key also demonstrates its limits as a standalone answer. Unit 42’s original attack worked using malware running as a standard user, without privilege escalation.

Preventing malicious code from running, and detecting it quickly when prevention fails, therefore matters more than relying solely on the absence of administrator rights.

Pass-Ta-Key Does not Mean Passkeys are Broken

There is a risk with research such as this that the headline becomes “passkeys can be stolen” and the more useful security lesson gets lost. Pass-ta-key does not defeat the cryptographic design behind WebAuthn. Nor does it restore the traditional phishing and credential-stuffing attacks that passkeys are designed to prevent.

Instead, it demonstrates an increasingly important principle: when one attack surface gets stronger, attackers move to another one.

If there is no reusable password to steal, attackers have an incentive to target the device holding the credential, the browser requesting authentication, the recovery process used to establish device trust or the session created after authentication.

Unit 42 reaches a similar conclusion: the attacks exploit the trust placed in client devices, inconsistent relying-party validation, and weaknesses in onboarding and recovery rather than breaking passkey cryptography itself.

What Can Organizations Do Now? 

Organizations can take a number of steps to protect users against these kinds of attacks:

• While passkeys reduce dependence on passwords, organizations still need to secure the password estate that remains during and after migration. Specops Password Policy with Breached Password Protection helps identify exposed credentials before attackers can exploit those remaining password-based paths. 
• Organizations also need to bring device trust into access decisions to mitigate the risk of stolen sessions and identify malware. Specops Device Trust continuously checks devices throughout sessions for active threats and binds identities to specific, authorized hardware, preventing account takeovers.
• Additional measures include protecting edge devices through principles of least access, and the use of EDR solutions and antiviruses.
• When implementing authentication systems like passkeys, ensure the implementation is well tested and all security controls are present; services like Outpost24 Cyberflex and regular security testing can verify such controls. 

If you’re interested in seeing how Specops can help protect your identities against evolving cyber threats, contact us today or book a demo to see our solutions in action.

Last updated on September 1, 2026