Pass the Passkey: A Novel Attack Surface in Passwordless Authentication

Researchers have identified new attack methods targeting Google's synced passkey system and Cloud Authenticator, allowing malware to bypass security measures and take over passkey-protected accounts without user interaction. These findings highlight emerging vulnerabilities in passwordless authentication as it scales globally.