Windows Passkey Flaw and SonicWall Attacks Expose Quiet Holes in ‘Passwordless’ Security
Researchers have uncovered Windows malware techniques that silently hijack passkey‑protected accounts, while INC ransomware crews are burrowing through SonicWall VPN flaws to steal credentials and one‑time codes. The twin findings show how attackers are turning “passwordless” logins and edge appliances into new entry points — leaving employees, customers and entire corporate networks exposed.
Two new sets of research are challenging some of the core assumptions behind modern corporate security, showing that both “passwordless” logins and hardened VPN gateways can be quietly subverted once attackers gain a foothold.
In one case, security researchers documented Windows malware that can silently sign into passkey‑protected accounts by abusing how Google Password Manager handles synced credentials in Chrome. They detailed three post‑compromise attack paths that allow malicious code to bypass user verification prompts, plant an attacker‑controlled passkey, or recover the secret material that protects a victim’s synced passkeys. Two of those methods can be used from a different machine altogether, turning a single infected device into a launchpad for long‑term account takeover.
Passkeys, promoted by major tech firms as a safer replacement for traditional passwords, are meant to tie authentication to hardware‑bound cryptographic keys rather than memorized strings. But the new research underscores a key caveat: if malware can reach the layer where those keys are stored or synchronized, the theoretical strength of the cryptography offers little comfort. An employee who clicks on a malicious attachment today could unwittingly give an intruder durable access to corporate email, cloud storage or development tools tomorrow, even after the visible infection is cleaned.
At the same time, a separate investigation has found that INC ransomware operators have become the leading group exploiting flaws in SonicWall SMA 1000 series appliances — widely deployed secure remote access devices that sit at the edge of corporate networks. By chaining together vulnerabilities, the attackers were able to extract stored credentials, active session tokens, and even time‑based one‑time password (TOTP) seeds from compromised devices.
For organizations, that kind of theft is particularly damaging. Credentials and TOTP seeds allow attackers to bypass multi‑factor authentication, log in as legitimate users and move laterally through networks without immediately triggering alarms. Active session hijacking means even users with good security hygiene can find their accounts abused mid‑session. Once inside, INC ransomware crews have been observed using that access to plant encryption tools, exfiltrate sensitive data and pressure victims into multimillion‑dollar payouts.
Human impact sits behind the technical jargon. Employees who have been told that passwordless logins and VPN boxes make them safe may feel blindsided when they learn that a single infected laptop or misconfigured gateway could expose payroll data, medical records or proprietary designs. IT and security teams, already stretched by patch cycles and compliance demands, now have to revisit some of their most foundational trust assumptions: that browser‑stored passkeys are inherently secure, and that perimeter devices faithfully enforce access controls rather than quietly leaking secrets.
Strategically, the twin findings point to a broader shift in how sophisticated attackers operate. Rather than battering front doors with brute‑force login attempts, they are increasingly focused on the infrastructure that issues and verifies identities — browser‑synced passkeys, VPN concentrators, single‑sign‑on platforms. Compromising those components lets them impersonate users at scale, bypassing many of the behavioral flags that traditional security tools rely on.
A concise way to frame it is this: the more we hide passwords behind layers of convenience, the more those layers themselves become the real target.
Signals worth watching in the coming weeks include how quickly browser vendors and platform providers harden passkey storage and syncing, whether SonicWall customers accelerate patching and add extra monitoring around their SMA 1000 devices, and if other ransomware or state‑linked groups start copying the same techniques to quietly burrow into high‑value networks.
Sources
- OSINT