Can somebody steal a passkey?

Palo Alto Networks has a threat research group called Unit 42, and on August 3 one of its researchers published a paper describing three new ways to attack passkeys. The researchers nicknamed them Pass-ta-key. The coverage that followed used words like "cracked" and "master key," and if you met one of those headlines in a Facebook feed you would reasonably conclude that passkeys are finished.

They are not. A passkey is the login that uses your face, fingerprint, or device PIN instead of a password, and I have told you here more than once to turn them on. I still would. The research is real though, and one piece of it is genuinely unpleasant.

Somebody has to already be on your computer

The paper says it in its own disclaimer. All three attacks rely on malware already running on the victim's device.

The scope is narrower still. This is Google Password Manager, in Chrome, on Windows, on a machine with a TPM security chip. Not an iPhone, not a Mac, not an Android phone.

Which does a lot of work. If someone is running their own software on your computer as you, they can already read the passwords saved in your browser, ride the sessions you are signed into, and watch the bank tab you left open. The passkey did not fail in that scenario. The computer was already compromised.

What the researchers actually did

Three attacks, in increasing order of damage.

The first one signs the attacker into your account with nothing appearing on your screen. It only works against websites that skip a check they are supposed to do, confirming that a person was actually verified. Unit 42 tried it on GitHub, which checked and refused. It tried eBay, which did not check and let the login through. eBay fixed that gap after being informed.

The second one convinces Google's service that the attacker's own computer just passed your fingerprint check. That buys reusable access from the attacker's machine, and your computer does not even have to be turned on for it.

The third one pulls out the single key that encrypts every synced passkey on the account. With that key in hand, an attacker can unlock all of them.

None of this breaks the cryptography, and Unit 42 says so plainly in its conclusion. The attacks go after the software around the passkey, mostly how Chrome sets a device up and what it leaves sitting in memory while it does.

The third one does not clean up

I am not going to soften this one, because it is the reason the research matters beyond a headline.

Google removed that master key from Chrome's debug log after the researchers reported it. The key still reaches your computer, though, and it still sits in memory for a moment during setup. In Google's current design there is no way to rotate it or revoke it. If someone got a copy, removing the malware does not take it back. Making fresh passkeys does not either, because the new ones are protected by the same key.

So if a Windows PC of yours gets hit by an information stealer, treat it as an account emergency and not just a computer cleanup.

What this research does not cover

Apple's iCloud Keychain, Microsoft's own passkey sync, passkeys held in 1Password or Bitwarden, hardware keys like a YubiKey, and passkeys on your phone were all outside this work. Unit 42 notes that other companies use a similar cloud design, so some of the same questions may apply. It did not test them.

Google answered the researchers in Chrome's public bug tracker and made one change there. As of August 2026 I have not found a statement from the company about the research itself. No CVE either, which is the tracking number a specific product flaw usually gets. Unit 42 describes its own testing under responsible disclosure, and I have not found a report of these techniques being used against a real person. That being said, it doesn't mean it has not happened.

Where passkeys really are weak

The soft spot has never been the passkey itself. It is the door beside it.

Almost every site that offers you a passkey leaves the password turned on as a fallback, and leaves the old reset path in place behind that. If your account can still be recovered with a code texted to your phone, then the passkey is the deadbolt and that code is the key under the mat. Criminals have noticed. Security researchers at Push Security documented phishing kits that offer a victim a phishable sign-in choice instead of letting the passkey run. That's all it takes because the attacker only has to find the weakest method that still works. That is the same argument as the selfie video Google wants for account recovery, and it is why the extra step at login still earns its annoyance.

What to do about it

• Keep the computer clean and patched. Automatic updates on, real protection running, and a healthy suspicion of anything that tells you to copy and paste a command to fix a problem. Patching is the closest thing to a password these days, and a machine that has started acting strange deserves a look. Most infections arrive through a fake update prompt or a poisoned download.
• Check the recovery path on your email account. Whoever can reset your email can reset almost everything else. If the only way back in is a text message, add an authenticator app or a second passkey.
• If you think a Windows PC is already infected, do the account work somewhere else. Changing a password on the infected machine hands the new one straight over. Use a different device, change what matters, sign out all sessions, then clean or rebuild the sick computer. The order of operations after any compromise is most of the battle.
• A hardware key is for people who are actually targeted. Reporters, executives, anyone managing money or systems for other people. It never syncs to the cloud, so none of this applies to it. For most readers it is a nice-to-have and not a requirement.

Nothing from these findings would dissuade me from still recommending passkeys. The next time a site offers you a passkey, take it. Then give the computer you are on the same attention. On a machine somebody else is running, every login you own is already in play.