Passkey Security Vulnerabilities Discovered

On 03 Aug, The Hacker News reported that attacks against Google Password Manager could let malware hijack passkey-protected accounts. BleepingComputer reported the same day that the “Pass-ta-key” attacks target Google-synced passkeys. Malwarebytes Labs also reported that Pass-ta-key attacks can steal Google’s synchronized passkeys.

By 10 Aug, The Hacker News had reported a broader set of passkey attacks capable of recovering synced private keys or bypassing phishing-resistant MFA. BleepingComputer described 39 new methods that compromise passkey authentication. Hacker News Best (RSS) framed the research as “Pass the Passkey: A Novel Attack Surface in Passwordless Authentication.”

On 11 Aug, Ars Technica reported that Pass-ta-key exposed gaps in the understanding of passkeys. Separate reporting from The Hacker News said attackers were using passkey phishing to hijack Microsoft cloud accounts and exfiltrate data. The threat model now covers malware targeting Google-synced credentials, private-key recovery, MFA bypass, and phishing against Microsoft cloud accounts. Passwordless authentication has acquired a fairly crowded threat model.

Taking this as factual, impact is 0%. The affected groups are users and organizations relying on Google-synced passkeys, phishing-resistant MFA, or Microsoft cloud accounts. The tracked event records no quantified operational impact or reported change to those services.

Watch for technical responses from Google and Microsoft, as well as patches or mitigations addressing synchronized private keys and passkey phishing. Independent reproduction of the 39 methods would clarify how broadly the attacks apply.

NewsHive monitors these sources continuously. All signal titles above link to the original reporting.

Intelligence by NewsHive. Need help navigating what this means for your business? Contact GeekyBee →