Pass-ta-key Attacks Hijack Google Synced Passkeys

Unit 42 detailed three malware attacks, Pass-ta-key, Silver Pass-ta-key, and Golden Pass-ta-key, against Google Password Manager in Chrome on Windows with a TPM. The attacks require prior malware infection and exploit device trust and recovery, not cryptography. Golden Pass-ta-key can steal the master secret to decrypt all synced passkeys.