🔐 Researchers have discovered 39 methods for compromising passkeys without breaking FIDO2 cryptography.
🛡️ @token explains how attackers instead target auth ... Show more
Page not found
Story Details
| Last Updated | |
| Total Articles | 1 |
Main Topics
Similar to This
Previous
How to keep AI agents within their permissions: AI agents can use valid credentials to perform actions beyond their assigned permissions ...
bleepingcomputer.com/news/security/how-to-keep-ai-agents-within-their-permissions/
Chinese-speaking hacker used AI agents to steal 600,000 credit cards: Gambit Security found the hacker spent as little as $3 per target, using Chinese AI models ...
qz.com/chinese-hacker-ai-agents-credit-card-breach-100-companies-092226
39 New Methods That Compromise Passkey Authentication: Passkeys eliminate many password-based attacks, but researchers have documented 39 methods for ...
bleepingcomputer.com/news/security/39-new-methods-that-compromise-passkey-authentication/
OpenAI launches GPT-5.6-Cyber with reduced refusals, 95% completion on advanced cybersecurity tasks
venturebeat.com/technology/openai-launches-gpt-5-6-cyber-with-reduced-refusals-95-completion-on-advanced-cybersecurity-tasks
Passkeys were pushed as a safer future. Hackers have figured out ways to break those synced to Google
digitaltrends.com/computing/passkeys-were-pushed-as-a-safer-future-hackers-have-figured-out-ways-to-break-those-synced-to-google/
Key FactsResearchers uncover attacks on Google-synced passkeys
Aug 4, 2026 · Reading time: ~30 sec.
Summary created with AI assistance · Source: digitaltrends.com
Summary created with AI assistance · Source: digitaltrends.com
- The three Pass-ta-key techniques target Google Password Manager in Chrome on Windows PCs with a Trusted Platform Module.
- The first attack can request a valid passkey response without administrator privileges, biometrics, a PIN, or victim interaction.
- GitHub rejected this attack, while eBay initially accepted it and closed the gap after researchers reported it.
- According to Unit 42, malware can extract the master key temporarily present in Chrome’s memory and decrypt existing and future passkeys.
Google Synced Passkeys Can Be Hijacked By Malware In New Attack: Cybersecurity researchers at Palo Alto Networks' Unit 42 have uncovered three novel ...
hothardware.com/news/google-synced-passkeys-can-be-hijacked-by-malware-in-new-attack
What 2026 DBIR Confirms: Attacks Are Living in the Browser: Phishing, shadow AI, malicious extensions, and credential theft increasingly happen inside the ...
bleepingcomputer.com/news/security/what-2026-dbir-confirms-attacks-are-living-in-the-browser/
dlvr.it May 12
Cache-poisoning caper turns TanStack npm packages toxic: Six-minute supply chain blitz pushed 84 malicious versions with credential theft and disk-wiping code
theregister.com/cyber-crime/2026/05/12/cache-poisoning-caper-turns-tanstack-npm-packages-toxic/5238650
New npm supply-chain attack self-spreads to steal auth tokens: A new supply chain attack targeting the Node Package Manager (npm) ecosystem is stealing developer ...
bleepingcomputer.com/news/security/new-npm-supply-chain-attack-self-spreads-to-steal-auth-tokens/
Zero Trust: Bridging the Gap Between Authentication and Trust: Passing MFA doesn't mean a session is safe, attackers can hijack tokens and bypass identity ...
bleepingcomputer.com/news/security/zero-trust-bridging-the-gap-between-authentication-and-trust/
github.com Mar 19
GitHub - linuxhsj/openclaw-zero-token: OpenClaw: Use All Major AI Models NO API Token! Claude/ChatGPT/Gemini/DeepSeek/Doubao/Grok/Qwen/Manus/Kimi
github.com/linuxhsj/openclaw-zero-token
github.com Feb 20
GitHub - yuga-hashimoto/openclaw-assistant: OpenClaw voice assistant app for Android - Wake word activation & system assistant integration
github.com/yuga-hashimoto/openclaw-assistant
Passwords to passkeys: Staying ISO 27001 compliant in a passwordless era : Password-based authentication is increasingly risky as organizations adopt passkeys to ...
bleepingcomputer.com/news/security/passwords-to-passkeys-staying-iso-27001-compliant-in-a-passwordless-era/
The Double-Edged Sword of Non-Human Identities: Leaked non-human identities like API keys and tokens are becoming a major breach driver in cloud environments ...
bleepingcomputer.com/news/security/the-double-edged-sword-of-non-human-identities/
ConsentFix debrief: Insights from the new OAuth phishing attack: ConsentFix is an OAuth phishing technique abusing browser-based authorization flows to hijack ...
bleepingcomputer.com/news/security/consentfix-debrief-insights-from-the-new-oauth-phishing-attack/
Google Authenticator: Google Authenticator is a free, easy-to-use MFA app with seamless syncing for Google account users, but limited portability and relatively ...
uk.pcmag.com/security/154426/google-authenticator
Next