Passkeys used as backdoor: iAuthFlow V2, the phishing that survives password change

The phishing landscape is enriched by a new commercial toolkit that aims at an ambitious goal: maintaining access to a Gmail account even after the victim has changed the password and revoked active sessions. Its name is iAuthFlow V2, and it was first observed on a Russian-language cybercriminal forum. Its operation is described in an analysis by Abnormal Security, based on the vendor's posts and public demonstrations, not on direct execution of the malware.

The toolkit is sold as phishing-as-a-service: the base package costs 10,000 US dollars, with additional modules available separately. A high price that suggests motivated and well-resourced actors, and that explains why public information about iAuthFlow V2 is still very limited. The distinctive feature, emerging from the analysis of materials released by the vendor, is the use of passkeys to achieve persistence that standard anti-phishing countermeasures cannot break.

The mechanism: two browsers and an invisible passkey

The scenario reconstructed by Abnormal Security takes a Gmail account as an example and consists of a sequence of steps that mix traditional phishing with a two-environment infrastructure.

The victim is lured to a web page controlled by the attacker through a classic phishing message. Here they enter their credentials, believing they are accessing the legitimate service. On the attacker's server, however, a second browser environment is active, separate but connected to the phishing page: it is this second browser that actually interacts with Google, while the victim interacts only with the fake page.

Credentials and authentication responses are forwarded to the second browser, which immediately applies a fingerprint to the victim's browser. Every input entered by the victim is recorded. At this point the toolkit silently adds a pre-provisioned passkey and forwards it to the second environment. Google, through the initial phishing page, asks the victim to complete authentication: if the phishing succeeds, the victim unknowingly also authorizes the passkey controlled by the attacker. The entire sequence aims to make the user, convinced they are protecting their account, actually add an alternative access method in the hands of the aggressor.

Why password reset is not enough

Normally, after a phishing compromise, the recommended procedure is to change the password and revoke active sessions. If the attacker has only stolen session cookies, these actions are sufficient to cut off access. Google notes that changing the password revokes app passwords and OAuth tokens with Gmail scopes, but some authorized devices and third-party connections may remain linked. The passkey, however, is not touched.

The passkey is a credential registered on the account, not a token derived from the password. Changing the password does not remove it. If the attacker controls the malicious passkey, they can later use it to log in by choosing "try another way" at sign-in, without knowing the password and without the session revocation having any effect. Access survives the reset and revocation: this is the feature that makes iAuthFlow V2 qualitatively more dangerous than traditional phishing kits, even in the absence of a CVSS score.

Limitations of the analysis and the information fog

The Abnormal Security analysis is not based on actual execution of the malware. The researchers did not purchase or run iAuthFlow V2, but reconstructed its operation from materials published by the vendor on the forum. This requires caution regarding operational conclusions, but the technical picture described is consistent with known passkey phishing techniques.

Public information about the toolkit is very limited, consistent with the high price and presumed stealthy operation. There are no associated CVEs or specific indicators of compromise made public: Abnormal Security states that it includes IOCs and remediation guidance in its analysis, but the operational details have not been disclosed in the report.

The picture is made even more opaque by the confusion of language models queried on the subject. Gemini describes iAuthFlow V2 as a commercial phishing-as-a-service toolkit/framework sold on underground forums, such as Exploit forum, but does not mention passkeys. Copilot provides an even more confused response. This shows that, at the moment, reliable sources are few and the researchers' analysis remains the main reference.

Risks for users and organizations

The victim of this type of attack does not only lose credentials: they lose control of alternative access methods. The attacker maintains access to the account even after the victim has performed standard remediation procedures. The malicious passkey remains registered on the account and allows future access without knowing the password. Possible consequences are continuous reading of email, data theft, and prolonged compromise of the account, which can extend for weeks or months.

For organizations, the risk is even greater: those who limit themselves to password reset and session revocation may not expel the attacker from the compromised account. In a corporate context, a Gmail account or another service linked to a domain can become a persistent door for data exfiltration or subsequent attacks against other employees.

How to defend yourself: check passkeys and alternative methods

The main lesson from Abnormal Security's analysis is that traditional countermeasures are no longer sufficient. Password change and session revocation alone do not interrupt access based on a malicious passkey. Anyone who suspects a compromise or wants to secure an account must check and remove any unrecognized registered passkeys or credentials. On Gmail and other services, the section dedicated to passkeys and alternative access methods must be checked item by item.

It is equally important to check authorized devices and third-party connections that may remain active after the password change, since Google warns that some of them can survive the reset. In general, after a phishing incident, every authentication method registered on the account should be considered potentially compromised, and everything unrecognized should be removed before considering the account safe.

The broader context, recently reported, shows that phishing is becoming more sophisticated and organized: FBI and Google dismantled the phishing service "Outsider Enterprise", over 500 organizations were hit in a multi-year campaign, and Microsoft warned of a sophisticated campaign against US organizations. iAuthFlow V2 fits into this trend, turning passkeys from a security tool into a persistence vector. Defense, accordingly, must update just as quickly.