[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f9CkEILwnc3bcO-w_-G9s5yzmkZHJJ07FLwah7-UfvCw":3,"$fWshoZIs0aKhYFwcN4oVoBDFNLQi0jjT09WUlYQEgeso":71},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":16,"hero_image_url":17,"structured":18,"story_type":67,"created_at":68,"updated_at":69,"published_at":70},"palo-alto-networks-unit-42-discloses-pass-the-passkey-attack-against-google-s-sy","Palo Alto Networks Unit 42 Discloses 'Pass the Passkey' Attack Against Google's Synced Passkey Ecosystem","Malware authenticates, bypasses user verification, and extracts all synced passkey private keys from Google's passkey sync mechanism.","Palo Alto Networks Unit 42 has identified a new 'Pass the Passkey' attack class that targets Google's synced passkey ecosystem, enabling malware to authenticate as the user, bypass user verification, and extract all synced passkey private keys.",[10,11,12,13,14,15],"Palo Alto Networks","Unit 42","Passkey","Google","Passwordless","CVE-2022-38028","# Palo Alto Networks Unit 42 Discloses 'Pass the Passkey' Attack Against Google's Synced Passkey Ecosystem\n\n*Malware authenticates, bypasses user verification, and extracts all synced passkey private keys from Google's passkey sync mechanism.*\n\n**Tags:** `Palo Alto Networks` `Unit 42` `Passkey` `Google` `Passwordless` `CVE-2022-38028`\n\n> Palo Alto Networks Unit 42 has identified a new 'Pass the Passkey' attack class that targets Google's synced passkey ecosystem, enabling malware to authenticate as the user, bypass user verification, and extract all synced passkey private keys.\n\n---\n\n## Vulnerability details\n\n| CVE | CVSS | EPSS | KEV | PoC | PRS risk |\n|---|---|---|---|---|---|\n| CVE-2022-38028 | 7.8 | 14.9% | ✅ listed | available | 76.83 (High) |\n\n## Pass the Passkey: A New Attack Class Against Google's Synced Passkeys\n\nPalo Alto Networks Unit 42 has disclosed a new attack class it calls “Pass the Passkey,” targeting the synchronized passkey ecosystem in Google Chrome. The technique allows malware to authenticate as the user, bypass the interactive verification step, and extract all synced passkey private keys from the browser profile.\n\nThe attack is a third entry in Unit 42’s passkey research series, following “The Art of the Invisible Key” and “Google Authenticator: The Hidden Mechanisms of Passwordless Authentication.” It represents a novel attack surface in passwordless authentication, where the attacker does not need to intercept the WebAuthn ceremony but instead operates from a resident process that reads the keys directly from Chrome’s sync store.\n\nPalo Alto Networks customers are protected through Cortex Cloud Identity Security, Idira Threat Detection and Response, Idira Endpoint Privilege Manager, and Idira Privilege. The vendor has shared the findings with Cyber Threat Alliance members for rapid deployment and disruption.\n\n## How the Attack Works\n\nThe malware authenticates against Google’s passkey sync endpoint to retrieve the user’s synchronized passkey set. It then bypasses the interactive user verification step—such as WebAuthn’s `userVerification` prompt—to extract the private keys directly from the browser profile. All synced passkey private keys are exfiltrated, enabling full offline authentication as the user without any further interaction.\n\n## Who Is Exposed\n\nThe attack targets the primary passkey sync clients in the Google ecosystem: Chrome, Cloud Authenticator, and the passkey sync backend. Unit 42 describes the technique as a resident process that reads the private keys directly from Chrome’s sync store, rather than intercepting the WebAuthn ceremony.\n\nVictims span AI\u002FLLM, E-commerce, Technology, airlines, government, and universities. The affected products are Cloud Authenticator, Chrome, and the passkey sync backend, which together form the synchronized passkey stack that stores and syncs the user’s private keys.\n\n## Palo Alto Networks Protections\n\nPalo Alto Networks customers receive protections through Cortex Cloud Identity Security, Idira Threat Detection and Response, Idira Endpoint Privilege Manager, and Idira Privilege Manager. The vendor has shared the findings with Cyber Threat Alliance members, who use the intelligence to deploy protections to their customers and disrupt the malicious actor.\n\n## Key points\n\n- New 'Pass the Passkey' attack class targets Google's synced passkey ecosystem, allowing malware to authenticate, bypass user verification, and extract all synced passkey private keys.\n- CVE-2022-38028 (Windows Print Spooler EoP) is rated CVSS 7.8, EPSS 14.9% (96th percentile), and is in CISA's Known Exploited Vulnerabilities catalog with a public PoC.\n- Palo Alto Networks customers are protected via Cortex Cloud Identity Security, Idira Threat Detection and Response, Idira Endpoint Privilege Manager, and Idira Privilege Manager.\n- Findings are shared with Cyber Threat Alliance (CTA) members for rapid protection deployment and systematic disruption of malicious actors.\n- This is part of a three-part series: Part 1 covers the passkey global breakthrough, Part 2 covers Google Authenticator's hidden mechanisms, and this post covers the Pass the Passkey attack.\n\n## Further reading & sources\n\n- [Pass the Passkey: A Novel Attack Surface in Passwordless Authentication](https:\u002F\u002Funit42.paloaltonetworks.com\u002Fpasswordless-authentication-security-risks) — PaloAlto Networks Unit 42\n- [Novel News on Cuba Ransomware: Greetings From Tropical Scorpius](https:\u002F\u002Funit42.paloaltonetworks.com\u002Fcuba-ransomware-tropical-scorpius)\n- [APT28 (Threat Actor)](https:\u002F\u002Fmalpedia.caad.fkie.fraunhofer.de\u002Factor\u002Fapt28)\n- [The Escalating Cyber Risk Landscape in Regional Conflicts & Strategic Actions for 2026](https:\u002F\u002Fblog.eclecticiq.com\u002Fthe-escalating-cyber-risk-landscape-in-regional-conflicts-strategic-actions-for-2026)\n- [Threat Assessment: BianLian](https:\u002F\u002Funit42.paloaltonetworks.com\u002Fbianlian-ransomware-group-threat-assessment\u002F)\n- [The AI Arms Race: How Adversaries are Weaponizing AI for Speed and Scale](https:\u002F\u002Fblog.eclecticiq.com\u002Fthe-ai-arms-race-how-adversaries-are-weaponizing-ai-for-speed-and-scale)\n- [Threat Brief: Mitigating Large-Scale Credential Attacks (Updated August 18)](https:\u002F\u002Funit42.paloaltonetworks.com\u002Flarge-scale-credential-attacks)\n- [Almost Half of Malware Samples Communicate Direct to IP](https:\u002F\u002Funit42.paloaltonetworks.com\u002Fmalware-bypass-dns-direct-to-ip)\n- [Token Jacking: Cybercriminals Could Be Stealing Your AI Resources](https:\u002F\u002Funit42.paloaltonetworks.com\u002Fai-token-jacking)\n- [Palo Alto Networks - Wikipedia](https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FPalo_Alto_Networks)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fpalo-alto-networks-unit-42-discloses-pass-the-passkey-attack-against-google-s-sy.png?v=12818dadac",{"cves":19,"actors":28,"timeline":36,"technologies":48},[20],{"id":15,"kev":21,"poc":21,"url":22,"cvss":23,"epss":24,"risk_band":25,"risk_score":26,"cvss_version":27},true,"\u002Fvulnerabilities\u002FCVE-2022-38028",7.8,0.1495,"High",72.33,"3.1",[29],{"url":30,"name":31,"slug":32,"type":33,"origin":34,"motivation":35},"\u002Fthreat-groups\u002Fapt28","APT28","apt28","apt","Russia (GRU Unit 26165)","espionage",[37,41,45],{"date":38,"event":39,"description":40},"2026-08-03","Disclosure","Publication of the Pass-ta-key research article",{"date":42,"event":43,"description":44},"2026-08-04","Publication","Palo Alto Networks Unit 42 published the research",{"date":46,"event":43,"description":47},"2026-08-06","Unit 42 publishes Token Jacking research",[49,51,53,55,57,59,61,63,65],{"vendor":10,"product":50},"Advanced WildFire",{"vendor":10,"product":52},"Advanced URL Filtering",{"vendor":10,"product":54},"Cortex XDR",{"vendor":10,"product":56},"Cortex XSIAM",{"vendor":10,"product":58},"Advanced DNS Security",{"vendor":13,"product":60},"Chrome",{"vendor":13,"product":62},"Cloud Authenticator",{"vendor":13,"product":64},"Gemini",{"vendor":10,"product":66},"Prisma AIRS AI Gateway","vulnerability_disclosure","2026-08-27T12:05:41.581419+00:00","2026-10-16T12:29:15.929573+00:00",null,{"articles":72},[73,84,97,110],{"slug":74,"title":75,"summary":76,"tags":77,"hero_image_url":82,"story_type":67,"created_at":83},"palo-alto-unit-42-s-nova-ai-finds-14-090-oss-vulnerabilities-in-two-months","Palo Alto Unit 42's NOVA AI Finds 14,090 OSS Vulnerabilities in Two Months","Palo Alto Networks Unit 42 released NOVA, an autonomous AI-driven vulnerability discovery system that analyzed 3,915 OSS projects in two months and confirmed 14,090 vulnerabilities, 99.4% of which were previously unreported and 40% rated high or critical.",[10,11,78,79,80,81],"NOVA","AI vulnerability discovery","open-source","agentic AI","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fpalo-alto-unit-42-s-nova-ai-finds-14-090-oss-vulnerabilities-in-two-months.png?v=e55edd825a","2026-08-27T12:08:58.15841+00:00",{"slug":85,"title":86,"summary":87,"tags":88,"hero_image_url":95,"story_type":67,"created_at":96},"red-hat-keycloak-critical-flaw-lets-unauthenticated-attackers-reset-any-account-","Red Hat Keycloak Critical Flaw Lets Unauthenticated Attackers Reset Any Account Password","Red Hat disclosed a critical vulnerability in Keycloak's reset-credentials flow that allows a remote unauthenticated attacker to bypass the email verification step and reset the password for any user account in any realm.",[89,90,91,92,93,94],"Keycloak","Red Hat","CVE-2026-18963","CVSS 9.1","account takeover","password reset","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fred-hat-keycloak-critical-flaw-lets-unauthenticated-attackers-reset-any-account-.png?v=94dc54a17a","2026-09-30T12:09:12.456253+00:00",{"slug":98,"title":99,"summary":100,"tags":101,"hero_image_url":108,"story_type":67,"created_at":109},"trend-micro-zdi-windows-shell-link-zero-day-exploited-by-11-state-backed-groups-","Trend Micro ZDI: Windows Shell Link zero-day exploited by 11 state-backed groups since 2017","Trend Micro's Zero-Day Initiative disclosed a new Windows Shell Link (.lnk) zero-day (ZDI-CAN-25373) exploited in the wild by 11 state-backed groups since 2017, which Microsoft declined to patch as 'not meeting the bar servicing'.",[102,103,104,105,106,107],"windows","shell-link","zero-day","ZDI","Trend Micro","state-sponsored","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ftrend-micro-zdi-windows-shell-link-zero-day-exploited-by-11-state-backed-groups-.png?v=a2818b0e7b","2026-09-30T12:04:13.324344+00:00",{"slug":111,"title":112,"summary":113,"tags":114,"hero_image_url":120,"story_type":67,"created_at":121},"head-mare-exploits-three-zero-days-to-trojanize-trueconf-atlassian-rovo-and-prog","Head Mare Exploits Three Zero-Days to Trojanize TrueConf, Atlassian Rovo, and Progress LoadMaster","The Head Mare APT group is actively exploiting three zero-day vulnerabilities in Atlassian Rovo, Progress LoadMaster, and Metabase, with Progress LoadMaster CVE-2026-8037 now on CISA KEV after 792 observed exploitation attempts.",[115,104,116,117,118,119],"Head Mare","Atlassian Rovo","Progress LoadMaster","Metabase","CVE-2026-8037","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fhead-mare-exploits-three-zero-days-to-trojanize-trueconf-atlassian-rovo-and-prog.png?v=48acc20ab2","2026-09-22T12:04:22.141581+00:00"]