As cited
Copy frozen at (site build).
threat intel
New Phishing Toolkit Uses Passkeys to Maintain Access After Password Resets
Researchers identified iAuthFlow V2, a phishing toolkit that registers attacker-controlled passkeys to maintain access after victims reset passwords and revoke active sessions. This technique circumvents traditional remediation steps and creates a persistent backdoor into compromised accounts.
Why it matters: Organizations relying on passkeys for passwordless authentication must assume passkeys obtained through phishing represent a full account compromise, since victims cannot regain exclusive control by changing passwords alone; detection and response plans should treat passkey registration as a critical escalation requiring forced passkey re-enrollment.
- Source published
- First seen by Cybersecurity Tracker