Possible Pass-ta-key Exfiltration of Synced Passkey Blob (WebauthnCredentialSpecifics) Correlated with Non-Browser Sync Data LevelDB Read

Duo Tech@duotech

•updated Aug 3, 2026•0•0•3

Detects likely exfiltration of encrypted synced passkey (WebauthnCredentialSpecifics) blobs to external C2 infrastructure, correlated with a prior non-browser read of Chrome's Sync Data LevelDB store, consistent with the collection-and-exfiltration stage of a Pass-ta-key credential-theft chain. Excludes traffic destined to Google's own domains.