$10,000 phishing kit survives password reset — here's the trick with passkeys
A new phishing toolkit called iAuthFlow V2 has been spotted on a Russian-language cybercrime forum. Its key feature is maintaining persistent access to a victim's account even after a password reset.
The base toolkit is priced at $10,000, with additional modules available separately. Researchers at Abnormal Security analyzed the tool based on the seller's forum posts and demonstrations, without acquiring or running the malware itself. They reconstructed its operation, focusing on the 'passkey' module as demonstrated against a Gmail account.
The attack begins like a typical phishing attempt: the victim lands on an attacker-controlled webpage and is tricked into entering their credentials. But the attacker has a second, connected browser environment running on their own server. As the victim interacts with the primary phishing page, their credentials and authentication responses are relayed to the remote browser, which actually processes the requests.
After the initial compromise, iAuthFlow V2 immediately applies a device fingerprint to the victim's browser. Each subsequent action by the user is logged. The malware silently adds a ready-made passkey to the victim's account. Since this passkey is bound to the device fingerprint, the attacker can use it to regain access even after the victim changes their password.
A passkey is an authentication standard based on public-key cryptography, supported by Google, Apple, and Microsoft. It is generally considered more secure than a password because it is resistant to phishing and server-side leaks. However, in this case, the attacker weaponizes the passkey: once added to the account, it becomes a backdoor that survives password reset, the most common remediation step.
The attacker's remote browser environment plays a crucial role. It allows the attacker to complete the authentication flow in real time, capturing session cookies and tokens that would otherwise be short-lived. The device fingerprinting ensures that the passkey remains usable from the attacker's environment, even if the victim's own device is later secured.
Abnormal researchers note that this technique represents a significant escalation in phishing sophistication. Traditional phishing kits lose access the moment the victim changes their password. iAuthFlow V2, by contrast, turns the passkey—a feature designed to enhance security—into a persistence mechanism. The tool is currently offered for sale on underground forums, and its availability could lower the barrier for advanced persistent phishing attacks.
