One PIN unlocks the vault

Opening Position

The Vaultjacking technique converts a single captured PIN into full retrieval of a victim’s Google Password Manager vault. One low-entropy secret, captured once through phishing, returns the complete credential set. The exchange rate between attacker effort and recovered data is not proportional to the value of the resource being protected.

This is a control collapse, not a phishing variant. Phishing that returns one credential is an account compromise. Phishing that returns a credential vault is a portfolio compromise. Every site the user delegated to the manager becomes attacker-controlled in a single capture event. The blast radius is defined by what the victim trusted to the manager, not by what the attacker specifically targeted.

The required response is not user education. The user entered the PIN they were conditioned to enter. The system returned the data it was built to return. The failure sits in the trust boundary the PIN was permitted to authorise across, not in user behaviour. Treating this as a phishing awareness problem misclassifies it.

What Actually Failed

A single PIN, captured through the Vaultjacking flow, results in retrieval of the full Google Password Manager vault. That is the externally observable outcome. One secret in, the entire credential set out. No additional condition, between PIN capture and vault retrieval, prevents the outcome from completing.

The implication is direct. The vault is gated on the PIN. The PIN is a short numeric secret. Phishing reliably captures short numeric secrets. The control was sufficient against the threat it was designed against. It is not sufficient against the threat Vaultjacking now demonstrates. Whether additional protections existed in the original threat model is not confirmed from the technique alone. What is confirmed is that they are not in force at the moment of capture-driven retrieval.

Operationally, this means a successful Vaultjacking capture is functionally equivalent to a bulk export of every credential the user delegated to Google Password Manager. The attacker does not phish each downstream site individually. The attacker phishes the manager once and inherits the rest. Banking credentials, corporate SSO entries, personal email, recovery emails, anything stored in the vault is now attacker-controlled in one operation.

Why It Failed

The PIN is being accepted as sufficient authorisation to release the vault. Vaultjacking captures the PIN through phishing and presents it. The vault is released. That sequence is the observable system behaviour. The system does not produce a differentiating signal between a PIN entered by the legitimate user on the legitimate surface and a PIN captured through Vaultjacking and presented through the attacker’s path. Whether additional contextual checks are evaluated and bypassed, or are not evaluated at all in this flow, is not confirmed. The result is the same.

The binding between the PIN and the scope it authorises is the structural condition the technique exploits. The PIN authorises access to the full credential set. It does not authorise access to one credential at a time. There is no per-credential challenge between the unlock event and the retrieval of any individual entry. Whoever clears the vault unlock clears the vault. That binding is the property Vaultjacking monetises.

Any control that depended on the PIN being unphishable is not in force. The PIN is phishable. Vaultjacking proves it at scale. Therefore every decision downstream of PIN entry, including the decision to release credentials to the calling surface, is operating on an authentication assumption that does not hold against this capture path. The control was effective against the original threat model. It is ineffective against this one. If the unlock surface accepts a captured PIN and returns the vault, the unlock surface is not enforcing the boundary it is presumed to enforce.

The mechanism is concentration of authority in a single low-entropy secret. The PIN is short. The PIN is numeric. The PIN is entered into a surface the user is conditioned to treat as routine. Vaultjacking does not break a cryptographic primitive. It collects an input the user is trained to provide and replays the conditions under which the system releases the vault. The technique succeeds because the authorisation decision has been compressed into a single factor that phishing reliably extracts.

The drift is in what the PIN was originally intended to gate versus what it now gates in practice. A short PIN is a reasonable control against a casual observer with brief physical access to an unlocked device. It is not a reasonable control against a remote adversary who can capture and present it through a controlled surface. The threat model the PIN was sized for and the threat model Vaultjacking operates in are not the same. The control did not change. The exposure did. Whether the unlock surface evaluates any signal beyond the PIN in this flow is not confirmed. What is confirmed is that no such signal stopped the release.

This is the failure pattern. A control is selected against an initial threat. The asset behind the control grows in value as more credentials accumulate behind it. The control is not resized. The attacker eventually targets the control directly because the return on capturing it now exceeds the return on attacking any individual downstream credential. Vaultjacking is the moment that calculation completes for Google Password Manager. The PIN is now the highest-value secret the user holds, because it releases every other secret the user holds, and it is the secret with the lowest entropy and the highest phishing yield.

The pattern is not specific to one vendor. Any system that gates a credential set behind a single short secret, and releases the full set on presentation of that secret, exhibits the same structural condition. The mechanism is independent of brand. The condition is: one secret authorises bulk retrieval, and that secret is reachable through user-facing input. Where those two properties coexist, a Vaultjacking-class capture is possible against that system. The specific implementation details determine the capture path. The structural exposure does not change.

The same pattern appears in other identity surfaces. A session cookie that authorises every API call behind a tenant. A bearer token that returns the full directory on a single read. A recovery code that resets authentication for an entire account family. In each case, a single artifact, captured once, authorises access to a population of resources whose individual values are higher than the cost of capturing the artifact. The defender carries the value of the population. The attacker pays the cost of capturing one secret. Vaultjacking is one expression of this asymmetry against a consumer credential store. It is not the only expression and it will not be the last.

The parallel that matters for operators is the credential manager category as a whole. Any manager that releases the full vault on a single unlock event inherits the same condition. The vendor name on the manager does not change the mechanism. If the unlock factor is phishable, and the unlock authorises bulk retrieval, the manager is one captured factor away from full disclosure. Whether specific managers implement per-credential challenges, hardware-bound unlock, or signed device attestation that would alter this calculation is not confirmed from the Vaultjacking facts and must be evaluated per product. The default assumption, absent confirmation, is that the same structural exposure applies.

A PIN that releases a vault is not protecting a vault. It is gating it against the wrong threat. The control was sized for shoulder-surfing and casual device access. It is being asked to carry the weight of every credential the user has ever delegated to the manager. Those are not the same job. Vaultjacking is the proof that the gap between them is now being operationalised. The control has not failed in the sense of malfunctioning. The control is being used outside the threat model it was effective against, and the result is the outcome the facts describe.

Identity is the boundary. The PIN is not identity. The PIN is a convenience factor that has been allowed to stand in for identity at the point where the most valuable retrieval in the system occurs. That substitution is the condition Vaultjacking monetises. Until the unlock event is bound to something the attacker cannot capture through a user-facing surface, the vault is reachable through the PIN, and the PIN is reachable through phishing. The chain holds end to end for the attacker. It does not hold end to end for the defender.

The operator position is direct. Treat any credential manager whose unlock factor is phishable and whose unlock authorises bulk retrieval as a single-point-of-failure asset for the identities behind it. Treat the PIN, in that configuration, as the most valuable secret the user holds. Treat user training as out of scope for the failure. The user entered what they were conditioned to enter. The system returned what it was built to return. The structural condition is what must change. Anything short of that leaves the next Vaultjacking capture sitting on the same path this one used.