iAuthFlow V2 Phishing Kit Uses Passkeys to Survive Password Resets

A sophisticated phishing toolkit dubbed iAuthFlow V2 is raising alarm across the cybersecurity community for its ability to maintain persistent access to compromised Gmail accounts even after the victim resets their password. First advertised on a Russian-language cybercrime forum with a $10,000 price tag, the toolkit leverages a novel passkey injection technique that neutralizes the standard remediation playbook. Security researchers at Abnormal Security analyzed the operation without acquiring or executing the malware, relying instead on the seller's forum posts and demonstrations.

The attack begins conventionally: the target lands on an attacker-controlled phishing page and submits credentials. What the victim cannot see is that a parallel browser session running on the attacker's server is relaying every input in real time. As credentials are entered, the toolkit silently registers a ready-made passkey against the target's account, and Google subsequently prompts the victim to authenticate that passkey through the original phishing interface. Because the target has already been social-engineered into trusting the page, the authentication request is approved, granting the attacker a cryptographic credential bound to the victim's identity. Standard protections like session revocation and password resets do not invalidate this passkey, since it is registered as an independent authentication factor on the account.

To re-enter a victim's mailbox, the attacker simply selects "try another way" at the Gmail login screen and authenticates using the stolen passkey, bypassing the password entirely. Abnormal Security notes that while Google revokes app passwords and OAuth tokens tied to Gmail scopes after a password change, registered passkeys remain active, creating a durable foothold. Defenders should verify whether unauthorized credentials have been registered on their accounts using an email breach checker, assess whether their browser environment leaks identifiable signals with a browser fingerprint test, and routinely rotate credentials verified through a password checker to catch weak or compromised secrets before they are exploited in campaigns like this one.