The Wolves Found The Sheep Tunnel Keys. Yes, The Ones You Synced To The Sky Pasture.

Oh good. Another Tuesday.

Researchers just dropped a report explaining that if your Windows machine is already hosting parasites, those parasites can now reach into Google Password Manager, grab your synced passkeys, and walk right out the front gate. Three separate attack methods. All of them working against the thing we were all told was the future of authentication.

The future is going great, everyone.

For the uninitiated: passkeys were supposed to be the cure. No more passwords, no more the flock clicking "ForgotMyPassword123" into fake grain sites. Just clean, cryptographic bliss. The Shepherds even sent a memo about it. I saw it. I wept.

Here's the problem. The moment you sync those keys up to the Sky Pasture through Google, they live on your device too. And if your device is already compromised, well. The ticks don't need your master password. They don't need to lure anyone. They just need to already be inside, which, let's be honest, they probably are.

Three attack paths. One abuses the way Google Password Manager handles user verification on Windows. Another bypasses that verification entirely by exploiting how the local authentication is implemented. The third one is the really fun one: it just extracts the private key material directly. The actual cryptographic soul of your passkey. Gone. Copied. Enjoyed by wolves at their leisure.

I'd be angrier but I haven't slept and my coffee went cold forty minutes ago and I have fourteen open tickets from the flock asking why their Zoom background isn't working.

The core issue is that "phishing-resistant" doesn't mean "parasite-resistant." These are different threat models and the industry has been quietly hoping nobody noticed. Somebody noticed. They wrote a paper about it.

The device is the trust boundary now. The device is compromised. You do the math.

Remediation

Look. You're not going to like this.

• Treat endpoint hygiene like it actually matters. Your Electric Fence configurations, your EDR, your application allow-listing. Do the shearing. Do it on schedule. Not "when we get to it."
• Do not let the flock run as local admins. I say this every quarter. Every quarter. Nothing changes.
• Audit what's syncing to the Sky Pasture. If you don't know what credentials are living up there, that's a you problem.
• Assume compromise. Not as a fun thought exercise. As a policy.

Passkeys are still better than passwords. They're just not magic. Nothing is magic. Magic is for lambs who haven't filed their first P1 incident yet.

Closing fourteen tickets now, none of which are about this.

Original Report: https://www.bleepingcomputer.com/news/security/new-pass-ta-key-attacks-let-malware-hijack-google-synced-passkeys/