iAuthFlow V2 Phishing Kit Adds Passkeys for Persistent Account Takeover

Researchers reported that iAuthFlow V2, a phishing toolkit advertised on a Russian-language cybercrime forum, can hijack a victim’s successful login and silently register an attacker-controlled passkey on the compromised account. The toolkit reportedly uses a browser-in-the-middle relay to capture credentials and authentication responses during a phishable sign-in flow, then authenticates an attacker-controlled browser session to enroll the new passkey. Demonstrations analyzed by Abnormal focused on Google accounts, where victims entered a password and authenticator-app code while the attacker gained a persistent credential tied directly to the account.

The reported persistence means attackers may be able to regain access even after a password reset and session revocation, because the enrolled passkey remains valid unless it is explicitly removed. The seller also advertised modules for Microsoft, iCloud, and LinkedIn, with pricing reportedly starting at $10,000 plus add-ons. Researchers said their findings were based on forum posts, Telegram content, demonstration videos, and vendor documentation rather than direct execution of the toolkit, and warned that incident response for such compromises should include checking for unauthorized passkeys, OAuth grants, and malicious mailbox rules instead of relying solely on password changes.