Malware can hijack Google synced passkeys on compromised Windows PCs

Intelligence Summary

Security researchers describe three passkey abuse techniques targeting Windows systems already compromised by malware. The malware can leverage Google Password Manager’s synced passkeys to gain unauthorized account access. These methods can bypass normal user verification steps and help attackers obtain passkey private keys. The exposure primarily affects users whose Windows devices are under attacker control and have Google passkeys synced. Users should reduce device compromise risk and review account security protections where possible.

Recommended Action

Review affected assets, schedule urgent remediation, and monitor related indicators.

Topics