Malware‑Driven “Pass the Passkey” Attack Threatens Password‑less Authentication Ecosystems
What Happened – Palo Alto Networks’ Unit 42 research reveals a new class of malware that can hijack Google’s synced passkey flow. By compromising an endpoint, attackers can misuse onboarding, recovery and device‑trust workflows to extract private keys and authenticate without any user interaction.
Why It Matters for Compliance & Audit Readiness
- The technique directly subverts SOC 2 CC6.1 (Logical Access) and CC6.2 (System Operations) controls that require strong authentication and protection of credential material.
- Continuous evidence of endpoint hardening, privileged‑access monitoring, and user‑verification policies becomes essential to demonstrate due‑diligence during a SOC 2 audit.
- Verisq’s SOC 2 Access Controls capability provides the audit‑ready evidence you need to prove that password‑less mechanisms are protected against malware‑driven credential compromise.
Who Is Affected – Cloud‑based SaaS providers, identity‑as‑a‑service platforms, enterprises adopting password‑less login (e.g., Google Workspace, Microsoft Entra), and any organization that relies on passkey authentication for employee or customer access.
Recommended Actions
- Map the “Pass the Passkey” scenario to SOC 2 CC6.1/CC6.2 controls and verify that endpoint protection, privileged‑access monitoring, and MFA policy enforcement are documented and continuously monitored.
- Deploy anti‑malware solutions with behavior‑based detection on all devices that can enroll or use passkeys.
- Enforce strict device‑trust enrollment policies and require periodic re‑authentication for high‑risk accounts.
- Incorporate the attack flow into security‑awareness training to educate users about the risks of compromised endpoints.
Source: Palo Alto Unit 42 – Pass the Passkey
Technical Notes
- Attack vector: Malware on a compromised endpoint that accesses the local passkey store and abuses cloud‑based onboarding/recovery APIs.
- No public CVE; the risk stems from workflow design rather than a software flaw.
- Data at risk: Private cryptographic keys backing passkeys, enabling full account takeover.