Pass the Passkey: A Novel Attack Surface in Passwordless Authentication

Researchers have uncovered critical flaws in Google’s passkey-based passwordless authentication, revealing that malware on a compromised endpoint can silently take over accounts, bypass user verification, and even extract all synced private keys, exposing a significant new attack surface for credential theft.