Suspicious Memory Access to Chrome Process for SDS Extraction (Golden Pass-ta-key)

Duo Tech@duotech

•updated Aug 3, 2026•6•0•13

Detects suspicious cross-process memory access or memory-dump activity targeting chrome.exe, consistent with extraction of the Security Domain Secret (SDS) master key or wrapped identity/UV private keys used to decrypt synced passkey credentials (Golden Pass-ta-key attack). Excludes known legitimate crash-dump and diagnostic tooling (WerFault, crashpad_handler, procdump, Chrome itself).