New Phishing Toolkit Uses Passkeys to Maintain Access After Password Resets
iAuthFlow V2 is a $10,000 phishing-as-a-service toolkit sold on Russian-language cybercrime forums that enables persistent account compromise by silently registering a passkey on the victim's account The attack uses a relay architecture where the attacker operates a second browser environment on their server, relaying credentials and authentication responses between the victim's browser and the target service in real time Unlike traditional phishing that relies on session cookies, iAuthFlow V2 r
Analysis
TL;DR
- iAuthFlow V2 is a $10,000 phishing-as-a-service toolkit sold on Russian-language cybercrime forums that enables persistent account compromise by silently registering a passkey on the victim's account
- The attack uses a relay architecture where the attacker operates a second browser environment on their server, relaying credentials and authentication responses between the victim's browser and the target service in real time
- Unlike traditional phishing that relies on session cookies, iAuthFlow V2 registers a passkey directly to the victim's account, which survives password resets and session revocations, granting the attacker long-term access
- The analysis is postulated from seller forum posts and demonstrations rather than actual malware acquisition, meaning operational details remain partially unverified
- Abnormal's key remediation recommendation is that a password reset alone is no longer sufficient to recover a compromised account; passkeys and authorized devices must also be audited and removed
Why It Matters
This represents a significant evolution in phishing methodology, shifting from session hijacking to credential registration hijacking, which undermines a core assumption in incident response: that password resets restore account security. As passkeys become increasingly adopted as a standard authentication mechanism across major platforms like Google, Microsoft, and Apple, threat actors are already weaponizing them, forcing security teams to reconsider their remediation playbooks and defensive strategies.
Technical Details
- Relay-based phishing architecture: The toolkit operates a two-browser environment — the victim interacts with a phishing page in their own browser, while a second browser on the attacker's server handles the actual authentication with the target service, relaying inputs and responses in real time
- Passkey registration attack: After initial credential capture, the malware silently registers a ready-made passkey on the victim's account (demonstrated against Gmail), which the attacker controls independently of the password
- Device fingerprinting: The toolkit immediately applies a device fingerprint to the target's browser and logs every interaction, enabling the attacker to maintain a persistent, context-aware session
- Persistence mechanism: Because a passkey is a registered credential rather than a derived token, standard password reset and session revocation procedures do not remove it, allowing the attacker to regain access via "try another way" login flows
- Commercial PhaaS model: The base toolkit is priced at $10,000 with additional modules sold separately, distributed through underground forums such as Exploit, following the growing trend of phishing-as-a-service commercialization
Industry Insight
- Security teams and incident responders must update their compromise remediation procedures to explicitly include auditing and removing registered passkeys, WebAuthn devices, and trusted authenticators — password resets alone are insufficient against this class of attack
- As passkey adoption accelerates across consumer and enterprise platforms, authentication providers should consider implementing alerts or mandatory re-authentication flows when a new passkey is registered on an existing account, creating a detectable signal for this attack vector
- The commercialization and escalating sophistication of PhaaS toolkits like iAuthFlow V2 signal that advanced phishing capabilities are becoming more accessible to a broader range of threat actors, warranting increased investment in behavioral detection, anomaly monitoring, and security awareness training focused on passkey-related social engineering
Disclaimer: The above content is generated by AI and is for reference only.