New Phishing Toolkit Uses Passkeys to Maintain Access After Password Resets
A new phishing kit called iAuthFlow V2 tricks victims into approving a fake login, then secretly registers an attacker's own passkey on their account. Because that passkey survives normal cleanup steps, the attacker can often get back in even after the victim changes their password.
- Report priority
- Medium
- Targets
- Gmail+1 more
How it works
- The victim enters their credentials on a fake login page that quietly relays everything to a hidden browser the attacker controls, which is the one actually talking to the real account.
- While the victim is tricked into approving a login prompt, the attacker's hidden browser also gets its own passkey added to the account without the victim realizing it.
What to do
There is no version number or scan to check here since this is a criminal phishing kit, not a software bug. The real risk is falling for a convincing fake login page and approving a passkey or sign-in prompt you did not expect.
After any suspected phishing, check your account's list of registered passkeys and sign-in methods and remove any you do not recognize, in addition to the usual password change, since Abnormal's research says a password reset alone may not remove an attacker-added passkey.
Technical details
Affected software: Gmail, Google
Abnormal Security analyzed iAuthFlow V2 based on the seller's forum posts and demonstration videos, without acquiring or running the malware itself. The kit runs a real-time adversary-in-the-middle relay: a primary phishing page shown to the victim is mirrored to a second, attacker-controlled browser session that performs the actual authentication with the target service. During that relay, the kit registers a WebAuthn passkey under the attacker's control and gets it authenticated when the victim approves a login prompt. Because password resets and session revocation target passwords, cookies, and tokens rather than registered authenticators, Abnormal notes the attacker's passkey may persist through standard incident response unless it is explicitly removed.