Pass-ta-key Attacks: Detecting Google Passkey Hijacking on Windows

---
title: Potential Pass-ta-key Attack - Chrome Local State Access
id: 9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects non-browser processes accessing Google Chrome's Local State file, a behavior associated with Pass-ta-key attacks to extract synced passkey master keys.
references:
  - https://www.bleepingcomputer.com/news/security/new-pass-ta-key-attacks-let-malware-hijack-google-synced-passkeys/
author: Security Arsenal
date: 2026/04/14
tags:
  - attack.credential_access
  - attack.t1552.001
logsource:
  category: file_access
  product: windows
detection:
  selection:
    TargetFilename|contains: '\Google\Chrome\User Data\Local State'
  filter_legit_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
  filter_legit_tools:
    Image|endswith:
      - '\explorer.exe'
      - '\SearchIndexer.exe'
      - '\ antivirus_executable' # Placeholder for specific AV
condition: selection and not 1 of filter_*
falsepositives:
  - Backup software accessing user profiles
  - Endpoint Detection and Response (EDR) scanners
level: high
---
title: Suspicious Process Accessing Chrome Login Data
copyright: Security Arsenal
id: 1f2e3d4c-5b6a-7980-1e2f-3a4b5c6d7e8f
status: experimental
description: Detects processes attempting to read Chrome 'Login Data' or 'Web Data' files, indicative of credential or passkey theft attempts.
author: Security Arsenal
date: 2026/04/14
tags:
  - attack.credential_access
  - attack.t1056.001
logsource:
  category: file_access
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\Google\Chrome\User Data\Default\Login Data'
      - '\Google\Chrome\User Data\Default\Web Data'
  filter:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
  condition: selection and not filter
falsepositives:
  - Security tools scanning for password hygiene
level: high

// Hunt for Pass-ta-key attack precursors: Accessing Chrome User Data files
DeviceFileEvents
| where Timestamp > ago(1d)
| where TargetFilename has "Google\\Chrome\\User Data"
| where TargetFilename has_any ("Local State", "Login Data", "Web Data")
| where not(InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe"))
| where not(InitiatingProcessCommandLine contains "--type=" and InitiatingProcessFileName == "chrome.exe") // Filter chrome utility processes
| project Timestamp, DeviceName, InitiatingProcessAccountId, InitiatingProcessFileName, InitiatingProcessCommandLine, TargetFilename, ActionType
| summarize count() by DeviceName, InitiatingProcessFileName, TargetFilename
| order by count_ desc

-- Hunt for processes holding handles to Chrome Local State file
-- This indicates a process is actively reading the master key storage
SELECT Pid, Name, Exe, CommandLine
FROM handles()
WHERE Name =~ "Local State"
  AND Name =~ "Chrome"
  AND Exe NOT =~ "chrome.exe"
  AND Exe NOT =~ "msedge.exe"
  AND Exe NOT =~ "velociraptor.exe" 
  AND Exe NOT =~ "ProgramData" 

<#
.SYNOPSIS
    Audit and Hardening Script against Pass-ta-key Attacks.
.DESCRIPTION
    This script checks for the existence of Google Chrome User Data stores
    and attempts to enable Windows Defender Credential Guard (if supported)
    to protect secrets from malware extraction. It also audits Chrome policies.
#>

# Check if Chrome is installed and locate User Data
$chromePath = "$env:LOCALAPPDATA\Google\Chrome\User Data"
$passkeyRiskDetected = $false

if (Test-Path $chromePath) {
    Write-Host "[+] Google Chrome User Data found at: $chromePath"
    Write-Host "[!] WARNING: If this endpoint is compromised, synced passkeys are vulnerable to Pass-ta-key extraction." -ForegroundColor Yellow
    $passkeyRiskDetected = $true
} else {
    Write-Host "[-] Google Chrome User Data not found."
}

# Check Windows Defender Credential Guard Status (Key Defense)
try {
    $cgStatus = Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard
    if ($cgStatus.SecurityServicesConfigured -band 1) {
        Write-Host "[+] Windows Defender Credential Guard is configured/enabled. This significantly mitigates credential theft." -ForegroundColor Green
    } else {
        Write-Host "[-] Windows Defender Credential Guard is NOT enabled." -ForegroundColor Red
        Write-Host "[!] Recommendation: Enable Credential Guard to protect passkeys from memory/malware scraping."
    }
} catch {
    Write-Host "[?] Could not determine Credential Guard status."
}

# Check for Chrome Group Policies restricting Sync
$registryPath = "HKLM:\SOFTWARE\Policies\Google\Chrome"
if (Test-Path $registryPath) {
    $syncDisabled = (Get-ItemProperty -Path $registryPath -ErrorAction SilentlyContinue).SyncDisabled
    if ($syncDisabled -eq 1) {
        Write-Host "[+] Chrome Sync is disabled via Group Policy. This blocks the Pass-ta-key vector for synced passkeys." -ForegroundColor Green
    } else {
        Write-Host "[-] Chrome Sync is NOT disabled via policy."
    }
} else {
    Write-Host "[!] No Chrome Sync policies found. Consider enforcing 'SyncDisabled' for high-risk environments."
}

if ($passkeyRiskDetected) {
    Write-Host "[Action Required] Review endpoints for unauthorized processes accessing: $chromePath"
}