Malware Exploiting Google Password Manager Can Steal Passkeys, Researchers Warn
A new attack technique allows malware on a device to hijack Google Password Manager and seize passkey-authenticated accounts, undercutting the security of passwordless logins.
Security researchers have demonstrated a concerning attack method that lets malware already running on a device compromise Google Password Manager and extract passkeys—the modern, phishing-resistant alternative to passwords. The technique does not exploit a vulnerability in the password manager itself but rather abuses its legitimate functionality from within a compromised operating system, highlighting that once an attacker gains sufficient privileges, even strong authentication factors can be lifted.
Google Password Manager stores passkeys in encrypted form, but when a user authenticates to a service, the manager must decrypt and present the passkey. Researchers found that malware with user-level access can inject code into the browser’s process, intercept the decrypted passkey material, and exfiltrate it to a remote server. Because passkeys are tied to a specific device, stealing the underlying private key effectively clones the credential, allowing the attacker to impersonate the victim on that service from elsewhere.
The implications for website owners and businesses are significant: user accounts protected by passkeys can still be taken over if the end-user device is infected. For online shops, membership sites, or any platform that relies on passkeys for user authentication, a single successful malware infection on a customer’s device could lead to account fraud, data theft, or unauthorized transactions. While passkeys remain vastly superior to passwords in resisting phishing and credential stuffing, they are not immune to local malware.
Google has acknowledged the research but notes that this is a known class of attack: if the operating system is compromised, any credential manager can be targeted. This underscores the importance of endpoint security—keeping devices free of malware is the first line of defense. For administrators of WordPress sites and other web applications, the news serves as a reminder that authentication security relies on both server-side hardening and user-side hygiene. Using a secure DNS resolver like AEU DNS that actively blocks known malware-distributing domains can add an extra layer of defense against the initial infection vectors.
Si të Mbroheni
- Keep your computer and phone updated: install operating system and browser updates as soon as they become available, because they fix security holes that malware often uses to get in.
- Be cautious about what you download: only install software and browser extensions from official app stores or trusted websites, and avoid clicking on suspicious links in emails or messages.
- Use a reliable antivirus or anti-malware program and keep it running; it can detect and stop malware before it has a chance to steal your passkeys.
- Consider using a secure DNS service that blocks known malicious websites—this can prevent your device from connecting to sites that try to drop malware in the first place.
- Regularly review your Google account’s security settings: check which devices are signed in, and sign out any you don’t recognize. Turn on two-factor authentication as an extra backup layer even when using passkeys.