iAuthFlow V2 Phishing Kit Enables Rogue Passkey Enrollment for Persistent Account Access

• •iAuthFlow V2 phishing kit allows persistent access via rogue passkeys.
• •The toolkit employs a browser-in-the-middle attack method.
• •Organizations should monitor for newly registered passkeys post-compromise.

The iAuthFlow V2 phishing toolkit, available for $10,000, allows attackers to enroll rogue passkeys on compromised accounts, ensuring persistent access even after victims change their passwords. This attack employs a browser-in-the-middle (BitM) technique, where victims interact with a phishing page while their credentials are relayed to an attacker-controlled browser. The kit targets services like Google, Microsoft, and iCloud, and has been observed in Russian-language cybercrime forums. Abnormal Security has documented the toolkit's capabilities, including a demonstration where a passkey was registered just six seconds after authentication. Organizations should be vigilant for newly registered passkeys during account compromise investigations. The toolkit's architecture enables attackers to bypass traditional security measures like session revocation and password changes.