Loading malware…
10 distinct techniques documented for this family, organized by ATT&CK tactic.
After the victim changes their password, the attacker’s session stops working. But the attacker can choose “Try another way,” use the passkey they previously added and regain access to the mailbox.
iAuthFlow v2 phishing toolkit uses a phished Google session to enroll an attacker-controlled passkey that survives password resets.
After the victim changes their password, the attacker’s session stops working. But the attacker can choose “Try another way,” use the passkey they previously added and regain access to the mailbox.
Once an attacker gains legitimate access to an account, that access can become a starting point for establishing new authentication methods, modifying account settings, and creating other forms of persistence.
Once the target completes a phishable Google login, the toolkit uses the authenticated session to enroll a passkey controlled by the operator.
After the victim changes their password, the attacker’s session stops working. But the attacker can choose “Try another way,” use the passkey they previously added and regain access to the mailbox.
Once an attacker gains legitimate access to an account, that access can become a starting point for establishing new authentication methods, modifying account settings, and creating other forms of persistence.
After the victim changes their password, the attacker’s session stops working. But the attacker can choose “Try another way,” use the passkey they previously added and regain access to the mailbox.
Once the target completes a phishable Google login, the toolkit uses the authenticated session to enroll a passkey controlled by the operator.
Once the relay gives the attacker’s browser Google’s session cookies, iAuthFlow v2 holds the target on a “Verification, Processing” page while the toolkit works inside the account.
Once the target completes a phishable Google login, the toolkit uses the authenticated session to enroll a passkey controlled by the operator.
The toolkit uses a browser-in-the-middle attack. The victim sees what looks like a real Google login page, while iAuthFlow v2 runs another browser on the attacker’s server.
The malware silently adds a ready-made passkey, and all is relayed to the second browser environment... the target will do so, but without knowing that this now includes authenticating the attacker-controlled passkey.
The full sweep should cover unauthorized passkeys and security keys, malicious Gmail filters and forwarding rules, delegated access, OAuth grants and app permissions, and recovery settings.
Use the Google Workspace Security Investigation Tool to investigate the account, then remove any unauthorized passkeys or security keys, delete malicious Gmail filters and forwarding rules
When an attacker’s access is limited to captured session cookies, those actions normally end that access... But this process does nothing to the new passkey which is a credential registered to the account rather than a token derived from the password.
The toolkit uses a browser-in-the-middle attack. The victim sees what looks like a real Google login page, while iAuthFlow v2 runs another browser on the attacker’s server.
3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.