Saturday 08 August 2026 11:35:11 GMT+02:00
Netcrook
#Google passkeys
How Malware Can Aim at Synced Passkeys Without Breaking the Math
Researchers demonstrated attack paths against Google’s synced passkey setup, showing that the weak point may be the device, browser, or recovery layer around the credential rather than WebAuthn itself.
Passkeys Were Supposed to Kill Password Theft. Malware Found the Device Instead.
The risk is no longer just phishing: on a compromised Windows machine, synced passkeys can become part of the attacker’s path to account takeover.
When Passkeys Follow the Device, Malware Follows the Trust
A new passkey attack write-up points to a harder truth about passwordless security: if the Windows endpoint is compromised, synced credentials can become part of the attacker’s path.