Bypass Record
LSASS Credential Dumping × Google Chrome
A publicly-reported instance of LSASS Credential Dumping bypassing Google Chrome, recorded with its original source. Factual record; no assessment of any specific deployment.
Mechanism
After gaining code execution on a Windows endpoint, malware can: 1) use Chrome DevTools Protocol to trigger passkey authentication and bypass user verification by simulating a virtual authenticator; 2) extract the raw private key material from Chrome's local state and decrypt it using the OS DPAPI; or 3) recover the Google Password Manager sync encryption key from Chrome's local state, then decrypt synced passkey private keys. These methods defeat the passkey's local user verification requirement and expose synced credentials.
Detection & mitigation
Monitor for suspicious use of Chrome DevTools Protocol (e.g., --remote-debugging-port) and access to Chrome's Local State or DPAPI-protected blobs. Deploy endpoint detection rules for credential dumping tools targeting browser data. Mitigate by enforcing phishing-resistant MFA and restricting local debugging interfaces.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.