mSecure tells users to reset passkeys as synced-key attacks surface

mSeven Software emailed mSecure customers on 3 November telling them to change passwords, reset two-factor authentication and remove passkeys after what it called suspicious activity. The warning followed a walkthrough published on 31 October that described finishing the setup on a PC in about a minute.

The warning is a reset order, not a diagnosis. Neither company has said how many users are affected or whether every attack path is closed.

The mSecure email landed four days after eSecurity Planet reported three techniques for hijacking synced Google passkeys. Millions of people are being nudged to add passkeys to accounts they use every day. The recovery paths around those passkeys are now the weak point. A compromised Windows PC or a hijacked inbox can undo the protection. The email went to current and former customers. It says mSeven Software recently learned of suspicious activity linked to the app. It does not say what happened or whether stored data was exposed.

mSeven Software said it started an investigation, took steps to limit the problem and brought in outside cybersecurity experts.

Public silence followed. As of 18:00 UTC on 3 November, mSeven Software had posted nothing about the email on mSecure's X and Facebook accounts. No staff member had replied in the support forum thread. The newest iPhone build of mSecure in Apple's App Store was 7.1.0, released on 23 October. The warning went out eleven days later. The email offers the steps as possibilities. It does not say whether customers should keep using mSecure.

Why passkeys are suddenly everyone's problem

note opened two-step authentication by passkey to all users on 26 October 2026, including free-plan users.

The feature had previously been limited to business plans. A walkthrough published on 31 October describes finishing the setup on a PC in about a minute. note did not remove the password. It kept it and added the passkey as a second check. That design matters for recovery. Users who lose their device can sign in with a six-digit code sent to their registered email. That is convenient, and it is a second door.

Synced passkeys can be hijacked, researchers say

Palo Alto Networks Unit 42 named three techniques. They could let malware on a Windows machine hijack passkeys synced through Google Password Manager, eSecurity Planet reported on 30 October.

They are Pass-ta-key, Silver Pass-ta-key and Golden Pass-ta-key. The basic version uses Chrome's TPM-backed device identity key to request a valid authentication assertion without administrator rights, biometrics, a PIN or user interaction. Unit 42 tested it against eBay, which did not validate the User Verified flag. eBay fixed it after disclosure. The third technique goes deeper. Golden Pass-ta-key targets the Security Domain Secret that encrypts synced passkeys. Google removed the secret from Chrome's internal FIDO logs after disclosure. The researchers said Chrome still receives it, and it remains briefly readable in process memory. Unit 42 did not report exploitation in the wild. The research does not identify affected Chrome versions or confirm that every attack path is closed.

The keys are not the whole story

mSecure says vault data is encrypted on the customer's device before it syncs. It says its developers cannot read customer information.

Germany's BSI found in a study published in December 2025 that mSeven Software could in theory access stored data in mSecure 6.1.5 for Android. The office tested only that version. Adam Lowe, chief technology officer at CompoSecure and founder of Arculus, told PaymentsJournal that a passkey is a non-phishable credential and still not enough by itself. "I've seen phones rootkitted, I've seen clouds hacked," he said. Amazon, he said, plans to be passwordless by 2030.

What is still unanswered

The mSecure email does not name the systems involved, say when the activity happened or whether it has stopped, or give a number of recipients. It does not say whether the activity reached vault data or the keys protecting it. It does not say whether the sync method matters.

Unit 42 raised a similar open question. The same secret protects existing and future synced passkeys, and Google's implementation reportedly offers no way to rotate or revoke it.