Full Report
Malware running as an ordinary user on a Windows machine can sign into a victim's passkey-protected accounts without a fingerprint, a PIN, or anything at all appearing on the victim's screen. Unit 42 detailed three attack paths against Chrome's Google Password Manager cloud authenticator, which it calls Pass-ta-key, Silver Pass-ta-key and Golden Pass-ta-key; the strongest targets the master key
Analysis Summary
# Tool/Technique: Pass-ta-key, Silver Pass-ta-key, and Golden Pass-ta-key
## Overview
These are three post-compromise attack paths identified by Unit 42 research targeting Google Password Manager’s cloud authenticator in Chrome for Windows. The techniques allow malware—running with standard user privileges—to access or hijack passkey-protected accounts without requiring the user’s physical interaction (biometrics or PIN) or showing any UI prompts.
## Technical Details
- **Type:** Technique / Post-Exploitation Method
- **Platform:** Windows (specifically Chrome with Google Password Manager and TPM enabled)
- **Capabilities:** Silent authentication assertion, unauthorized user-verification key registration, and extraction of the Security Domain Secret (SDS).
- **First Seen:** Publicly detailed in August 2026 (Unit 42 research).
## MITRE ATT&CK Mapping
- **[TA0006 - Credential Access]**
- [T1555 - Credentials from Web Browsers]
- [T1539 - Steal Web Session Cookie] (Related mechanism)
- **[TA0009 - Collection]**
- [T1539 - Steal Web Session Cookie]
- **[TA0004 - Privilege Escalation]**
- [T1548 - Abuse Elevation Control Mechanism] (Bypassing User Verification)
## Functionality
### Core Capabilities
- **Pass-ta-key:** Extracts the wrapped device identity key and uses Windows CNG APIs to force the TPM to sign requests silently. It generates a valid assertion with the "User Verified" (UV) bit unset.
- **Local Reconnaissance:** Malware scans `%LocalAppData%\Google\Chrome\User Data\Sync Data\LevelDB` to identify target relying parties (websites), usernames, and encrypted private-key material.
### Advanced Features
- **Silver Pass-ta-key:** Forces device re-enrollment to register an attacker-controlled user-verification key. Because the service may not verify if the key originated from secure hardware, the attacker can later sign assertions with the UV bit set, bypassing human presence requirements.
- **Golden Pass-ta-key:** Targets the extraction of the 32-byte Security Domain Secret (SDS). This allows the attacker to decrypt synced passkey private keys and maintain reusable access from their own environment, independent of the victim's device.
## Indicators of Compromise
- **File Names:** Local database files located at `%LocalAppData%\Google\Chrome\User Data\Sync Data\LevelDB`.
- **Behavioral Indicators:**
- Unprivileged processes making repeated or unusual calls to Windows Cryptography API: Next Generation (CNG) specifically for TPM-backed keys.
- Unexpected modifications to Chrome’s enclave local state or re-enrollment triggers.
- Execution of code that attempts to suppress `NCryptSignHash` UI prompts.
## Associated Threat Actors
- No specific threat actors were identified in the report; these are currently theoretical post-compromise techniques developed by researchers.
## Detection Methods
- **Behavioral Detection:** Monitoring for unprivileged processes accessing Chrome’s sensitive `LevelDB` directories or making unauthorized calls to `ncrypt.dll` functions that interact with TPM-stored identity keys.
- **Web Analytics:** For Relying Parties (websites), detecting authentication assertions where the "User Verified" (UV) bit is missing, especially if the user typically performs high-assurance logins.
## Mitigation Strategies
- **For Relying Parties (Websites):** Strictly enforce the `userVerification: required` flag in WebAuthn configurations to reject assertions where the UV bit is not set.
- **For Developers/Chromium:** Implementing TODOs to label TPM keys (preventing reuse via opaque blobs) and ensuring User Verification keys are strictly bound to secure hardware during enrollment.
- **Endpoint Hardening:** Standard malware prevention to stop the "initial endpoint compromise" required for these techniques to function.
## Related Tools/Techniques
- **Pass-the-Hash / Pass-the-Ticket:** Conceptually similar "pass-the-credential" style attacks adapted for modern WebAuthn/Passkey architectures.
- **Chrome Sync Hijacking:** Techniques involving the theft of synchronization tokens to access cloud-stored data.