Pass-ta-Key: Novel Attacks on Synced Passkey Authentication

Hunting Controls & Observations

The Pass-ta-Key attacks run from an already-compromised endpoint and abuse local storage, browser process memory, and the passkey onboarding workflow rather than dropping new malware families. Detection depends on watching how legitimate components are used, not on file signatures. Organizations can hunt this activity across the following telemetry sources:

• Endpoint Controls: EDR/XDR and Sysmon coverage for process creation (Event 1), sensitive process access (Event 10), file creation and deletion (Events 11, 23, 26), especially involving the browser profile and password manager storage.
• Identity & Access Controls: Sign-in and audit logs from identity providers and relying parties, including passkey and security-key authentication method, sign-in location, and the assertion signature counter.
• Network Controls: Outbound connections to authenticator sync endpoints originating from processes other than the browser.
• Cloud & SaaS / Application Controls: Password manager recovery and re-onboarding events, including recovery-PIN prompts and new user-verification key registrations.

Behavioral Indicators of Attack

The following observations distinguish this activity from routine passkey use:

• A process other than the browser reading the Chrome sync database directory (the local Sync Data\LevelDB store) that holds passkey credential records.
• Non-browser processes calling Windows cryptography APIs such as NCryptImportKey and NCryptSignHash to import and sign with a stolen identity key, without any privilege escalation.
• Deletion or renaming of the passkey_enclave_state device-key file, which forces the account into a re-onboarding flow the attacker can hijack.
• A passkey device entering the pending user-verification (uv_key_pending) state outside of a genuine new-device setup, followed by a device/add_uv_key registration.
• A non-system process opening a handle to the browser process and reading its memory, particularly during a passkey recovery flow.
• Access to the browser debug surface that exposed the plaintext master key (chrome://device-log/FIDO) or reads of its on-disk artifact.
• Passkey assertions for the same credential appearing from multiple locations, or carrying a static (non-incrementing) signature counter, signaling use from an unexpected environment.
• Repeated or unexpected password manager recovery-PIN prompts during otherwise routine passkey sign-ins.

MITRE Enterprise ATT&CK Tactics and Techniques

The Unit 42 report does not publish a formal MITRE ATT&CK mapping; the techniques below are inferred from the documented behaviors and follow the attack flow:

• Credential Access (T1555.003 – Credentials from Password Stores: Credentials from Web Browsers): Malware reads the Chrome sync database and Google Password Manager storage to obtain encrypted passkey records and the wrapped identity key, without requiring elevated privileges.
• Credential Access (T1552.001 – Unsecured Credentials: Credentials In Files): The passkey master key (Security Domain Secret) was exposed in plaintext inside a browser debug-log surface readable by any local process before the vendor removed it.
• Defense Evasion (T1070.004 – Indicator Removal: File Deletion): The attacker deletes the local device key state file to invalidate the legitimate key and trigger a re-onboarding sequence they control.
• Persistence (T1556 – Modify Authentication Process): During forced re-onboarding the attacker registers their own user-verification key; because the cloud authenticator does not validate attestation of new keys, this grants reusable remote access.
• Credential Access (T1606 – Forge Web Credentials): Using the stolen identity and passkey keys, the attacker signs authentication assertions that relying parties accept as genuine.
• Credential Access (T1528 – Steal Application Access Token): The attacker obtains valid assertions from the cloud authenticator and forwards them to relying parties to authenticate as the victim.