Organization

Unit 42

3 mentions in 7 days · 77 in 30 days · 82 total · first seen Aug 11, 2026 · last 5d ago

Timeline82 articles

Google Password Manager Attacks Could Let Malware Hijack Passkey

Unit 42 details three attack paths letting Windows malware silently sign into passkey-protected accounts via Chrome's Google Password Manager without user verification.

Palo Alto Networks Unit 42 described three post-compromise attack paths—Pass-ta-key, Silver Pass-ta-key and Golden Pass-ta-key—against Chrome's Google Password Manager cloud authenticator on TPM-equipped Windows systems. The attacks can silently obtain valid authentication assertions, install attacker-controlled user-verification keys, or extract the 32-byte Security Domain Secret used to decrypt synced passkey private keys, enabling reusable access from the attacker's own environment. No CVE was assigned and no exploitation in the wild was reported; demonstrations were validated against Chrome 142 and parts of the architecture are corroborated by Chromium source. GitHub enforced the User Verified flag check, while eBay accepted a test assertion lacking it before fixing its validation gap after disclosure.

The Hacker NewsAug 11, 20:22 UTC · Aug 11, 2026Research

New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing

Three research teams showed passkey bypasses: WebAuthn assertion replay in Microsoft Entra ID, synced-passkey key recovery in Google Password Manager, and Windows Hello key reuse.

SpecterOps' Pass-the-Passkey research showed Windows stored past YubiKey signatures in cleartext and chained this with Microsoft Entra ID passkey validation weaknesses to impersonate privileged users despite phishing-resistant MFA; the Windows Event Logging Service issue is tracked as CVE-2026-34348 (CVSS 6.5) and fixed in July 2026 updates. Unit 42's Golden Pass-ta-key attack recovered the 32-byte Security Domain Secret protecting Google Password Manager synced passkeys from Chrome on Windows via pre-existing malware. Dirk-jan Mollema showed in-session malware can use a hardware-bound Windows Hello for Business key without a fresh PIN or biometric check. Microsoft applied Entra-side mitigations for the relay assertion issue; no real-world exploitation has been reported.

The Hacker NewsAug 11, 12:45 UTC · Aug 11, 2026Vulnerability CVE-2026-34348

Related CVEsby mentions

CVE-2023-32888.8<1%
A BOLA vulnerability in POST /providers allows a low privileged user to create a privileged user (provider) in the system.
A BOLA vulnerability in POST /providers allows a low privileged user to create a privileged user (provider) in the system. This results in privilege escalation.
· easyappointments easyappointments—
CVE-2023-32878.8<1%
A BOLA vulnerability in POST /admins allows a low privileged user to create a high privileged user (admin) in the system.
A BOLA vulnerability in POST /admins allows a low privileged user to create a high privileged user (admin) in the system. This results in privilege escalation.
· easyappointments easyappointments—
CVE-2023-380518.1<1%
A BOLA vulnerability in GET, PUT, DELETE /secretaries/{secretaryId} allows a low privileged user to fetch, modify or delete a low privileged user (secretary).
A BOLA vulnerability in GET, PUT, DELETE /secretaries/{secretaryId} allows a low privileged user to fetch, modify or delete a low privileged user (secretary). This results in unauthorized access and unauthorized data manipulation.
· easyappointments easyappointments—
CVE-2023-380508.1<1%
A BOLA vulnerability in GET, PUT, DELETE /webhooks/{webhookId} allows a low privileged user to fetch, modify or delete a webhook of any user (including admin).
A BOLA vulnerability in GET, PUT, DELETE /webhooks/{webhookId} allows a low privileged user to fetch, modify or delete a webhook of any user (including admin). This results in unauthorized access and unauthorized data manipulation.
· easyappointments easyappointments—
CVE-2023-380548.1<1%
A BOLA vulnerability in GET, PUT, DELETE /customers/{customerId} allows a low privileged user to fetch, modify or delete a low privileged user (customer).
A BOLA vulnerability in GET, PUT, DELETE /customers/{customerId} allows a low privileged user to fetch, modify or delete a low privileged user (customer). This results in unauthorized access and unauthorized data manipulation.
· easyappointments easyappointments—
CVE-2023-32857.7<1%
A BOLA vulnerability in POST /appointments allows a low privileged user to create an appointment for any user in the system (including admin).
A BOLA vulnerability in POST /appointments allows a low privileged user to create an appointment for any user in the system (including admin). This results in unauthorized data manipulation.
—
CVE-2023-32896.5<1%
A BOLA vulnerability in POST /services allows a low privileged user to create a service for any user in the system (including admin).
A BOLA vulnerability in POST /services allows a low privileged user to create a service for any user in the system (including admin). This results in unauthorized data manipulation.
· easyappointments easyappointments—
CVE-2024-13136.5<1%
It is possible for a user in a different organization from the owner of a snapshot to bypass authorization and delete a snapshot by issuing a DELETE request to
It is possible for a user in a different organization from the owner of a snapshot to bypass authorization and delete a snapshot by issuing a DELETE request to /api/snapshots/ using its view key. This functionality is intended to only be available to individuals with the permission to write/edit to the snapshot in question, but due to a bug in the authorization logic, deletion requests issued by an unprivileged user in a different organization than the snapshot owner are treated as authorized. Grafana Labs would like to thank Ravid Mazon and Jay Chen of Palo Alto Research for discovering and…
—
CVE-2023-32905.0<1%
A BOLA vulnerability in POST /customers allows a low privileged user to create a low privileged user (customer) in the system.
A BOLA vulnerability in POST /customers allows a low privileged user to create a low privileged user (customer) in the system. This results in unauthorized data manipulation.
· easyappointments easyappointments—
CVE-2024-222784.3<1%
Incorrect user permission validation in Harbor <v2.9.5 and Harbor <v2.10.3 allows authenticated users to modify configurations.
Incorrect user permission validation in Harbor <v2.9.5 and Harbor <v2.10.3 allows authenticated users to modify configurations.
· linuxfoundation harbor—

Appears with

vendor Palo Alto Networks 65 organization Palo Alto Networks 30 vendor Microsoft 13 product Cortex XDR 8 product Advanced URL Filtering 6 malware Angler EK 6 vendor Unit 42 5 threat actor Unit 42 5 malware Mirai 5 organization CISA 5 product Cortex Xpanse 4 vendor Advanced DNS Security 4 threat actor EITest 3 product WildFire 3 malware Trickbot 3 malware web skimmers 3

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.