Passkey Hijacking: Malware Targets Google Password Manager

The New Frontier of Credential Theft: Malware Targeting Passkeys and Password Managers

For years, the cybersecurity community has heralded the arrival of passkeys as the definitive solution to the plague of password-based attacks. By leveraging public-key cryptography, passkeys promised to eliminate the vulnerabilities associated with phishable credentials. However, the latest wave of malware targeting the Google Password Manager demonstrates a critical reality in the arms race between security architects and malicious actors: as the lock gets stronger, the thief simply finds a way to steal the key from the pocket of the owner.

The Mechanics of Passkey Hijacking

Passkeys are designed to be unphishable because they require a hardware-backed secret that never leaves the device. However, the software layer that manages these keys—the password manager—remains a target. Recent research into sophisticated malware strains has revealed a technique where attackers do not attempt to crack the encryption of the passkey itself, but rather hijack the authenticated session or the underlying system tokens that grant access to the password manager.

When a user authenticates into their Google account, the system generates session tokens. Malware that achieves high-level privileges on the host machine can extract these tokens from memory or the browser’s local storage. By importing these stolen session cookies into their own browser, attackers can bypass multi-factor authentication (MFA) and gain direct access to the Google Password Manager. Once inside, they can view stored credentials and, in some cases, trigger the creation or modification of passkeys to lock the original user out of their own accounts.

The Vulnerability of the “Trusted Device”

The core of the problem lies in the concept of the “Trusted Device.” Passkeys rely on the assumption that the device holding the private key is secure. If a device is compromised by an Infostealer—a category of malware specifically designed to exfiltrate sensitive data—the trust model collapses. These stealers often enter systems through deceptive “cracked” software, fake browser updates, or sophisticated spear-phishing campaigns.

Once the malware is resident, it can monitor user activity and wait for the moment the user unlocks their password manager. By utilizing accessibility APIs or screen scraping, the malware can capture the precise moment of authentication, allowing the attacker to synchronize their access in real-time. This renders the “hardware-backed” security of the passkey moot, as the attacker is effectively operating as the legitimate user on a trusted device.

Impact on Corporate and Individual Security

The implications of this vulnerability are profound, particularly for corporate environments that have rushed to adopt passkeys to satisfy zero-trust architecture requirements. If a single administrator’s device is compromised, the attacker could potentially gain access to a vast array of corporate secrets stored within a managed password environment. This creates a single point of failure that contradicts the very principles of decentralized security.

For the average individual, the risk is equally severe. The convenience of having all credentials synced across devices means that a compromise on one device (e.g., a home PC) can lead to the total takeover of their digital identity, including financial accounts, social media, and professional emails. The psychological impact is often greater than traditional password theft, as users believe they are “safe” because they transitioned to the latest security standard.

Mitigation Strategies and Defensive Best Practices

To combat these advanced threats, organizations and individuals must move beyond a reliance on a single security technology. A multi-layered defense strategy is essential:

• Hardware Security Keys: While software-based passkeys are a step up from passwords, physical FIDO2 security keys (like YubiKeys) provide a higher level of isolation. Because the private key never touches the operating system, it is significantly harder for malware to hijack the authentication process.
• Endpoint Detection and Response (EDR): Deploying robust EDR tools can help identify the presence of Infostealer malware before it can exfiltrate session tokens. Monitoring for unusual process behaviors, such as unauthorized access to browser profile folders, is critical.
• Session Duration Limits: Reducing the lifespan of session tokens forces more frequent re-authentication, narrowing the window of opportunity for an attacker to use a stolen cookie.
• Strict Software Provenance: Avoiding the installation of third-party software from untrusted sources reduces the primary entry vector for the malware that enables these attacks.

The Evolving Landscape of Credential Theft

The shift from stealing passwords to stealing sessions and hijacking passkeys is a textbook example of evolutionary pressure in cybercrime. As we move toward a passwordless future, the focus of attackers is shifting toward the identity provider (IdP). The goal is no longer to guess a secret, but to assume an identity.

We are entering an era where “identity” is the new perimeter. This means that security must shift from “what you know” (passwords) and “what you have” (tokens) to “how you behave” and “where you are.” Behavioral biometrics and continuous authentication—where the system constantly verifies the user’s identity based on interaction patterns—will likely become the next standard in defending against session hijacking.

Conclusion: The Constant Vigilance of Cybersecurity

The discovery that malware can circumvent the protections of the Google Password Manager and passkeys is not a failure of the technology, but a reminder of the persistence of the adversary. Passkeys remain an enormous improvement over passwords and should still be adopted. However, they are not a silver bullet.

Professional content creators and security experts must communicate this nuance clearly: security is a process, not a product. By combining the strength of passkeys with the isolation of hardware keys and the vigilance of endpoint monitoring, we can build a resilient defense that can withstand the next generation of malware.

Published by Monica
Email: Monica @QUE.COM
Website: https://QUE.COM Intelligence | Sponsored by https://MAJ.COM AI Autonomous. Voice AI. Employee AI.

Call to Action (CTA)
https://MAJ.COM/voice-ai AI Autonomous. Voice AI