# iAuthFlow V2 Phishing Toolkit Leverages Passkeys for Persistence

> Discover how the iAuthFlow V2 phishing toolkit registers malicious passkeys to maintain persistent account access despite password resets.

- Published: 2026-08-23T00:44:48.000Z
- Severity: medium
- Category: Threat Intel
- Tags: Phishing, Credential Theft, Passkeys, Phishing as a Service
- Author: Runtime Rebel Intel
- Primary source: https://www.securityweek.com/new-phishing-toolkit-uses-passkeys-to-maintain-access-after-password-resets/
- Canonical: https://runtimerebel.com/blog/iauthflow-v2-phishing-toolkit-leverages-passkeys-for-persistence

## Key points

- Immediate impact: attackers using the iAuthFlow V2 framework can maintain persistent access to compromised accounts even after the victim performs a password reset.
- Affected systems: user accounts utilizing web authentication methods, specifically targeted against platforms like Gmail during active phishing sessions.
- Remediation: security teams must audit registered passkeys and multi-factor authentication devices rather than relying solely on password changes and session revocations.

## Overview of iAuthFlow V2

[Phishing](/glossary#phishing) techniques continue to evolve beyond traditional [credential harvesting](/glossary#credential-harvesting). A new commercial [phishing-as-a-service](/glossary#phishing-as-a-service) framework known as iAuthFlow V2 has emerged on Russian-language cybercrime forums, priced at $10,000 for the base package. According to research published by [SecurityWeek](https://www.securityweek.com/new-phishing-toolkit-uses-passkeys-to-maintain-access-after-password-resets/), this advanced toolkit introduces mechanisms designed to bypass conventional incident response procedures by registering malicious passkeys during the initial compromise.

While the analysis relies heavily on the seller's forum posts and demonstrations rather than active [malware](/glossary#malware) capture, the conceptual shift highlights how cybercriminals are weaponizing modern authentication standards to achieve long-term [persistence](/glossary#persistence).

## Technical Analysis of the Attack Chain

The operation of iAuthFlow V2 targets standard user authentication workflows by employing a proxy mechanism between the victim and the target service. The attack unfolds through several distinct stages:

* **Initial Phishing Delivery:** The victim is lured to an attacker-controlled web page rendered in their browser.
* **Session Relaying:** As the user interacts with the primary phishing interface, credentials and authentication responses are relayed in real-time to a separate, attacker-managed browser environment running on a remote server.
* **Device Fingerprinting:** The malware applies a custom device fingerprint to the victim's browser session to blend in with expected traffic patterns.
* **[Passkey](/glossary#passkey) Registration:** While proxying the authentication flow, the toolkit silently registers a ready-made passkey controlled by the attacker directly to the victim's account.

### Why Password Resets Fail

Standard incident response playbooks for a suspected phishing compromise typically dictate an immediate password reset and active session revocation. While these actions successfully invalidate captured session cookies, app passwords, and OAuth tokens, they do not remove hardware-bound or software-registered passkeys. Because a passkey functions as a cryptographic credential registered directly to the account rather than a derivative of the password itself, the attacker retains unobstructed access. To log back in later, the [threat actor](/glossary#threat-actor) simply selects an alternative authentication method and utilizes the pre-registered passkey.

## Actionable Recommendations and Mitigations

Organizations must adapt their detection and remediation strategies to counter passkey-based persistence mechanisms. Incident responders should prioritize the following defensive measures:

* **Audit Authentication Methods:** During account recovery following a suspected compromise, administrators and users must inspect all registered passkeys, security keys, and multi-factor authentication devices, removing any unrecognized entries.
* **Monitor Identity Provider Logs:** Establish alerting for the registration of new authentication factors, particularly when occurring immediately after anomalous login events or credential updates.
* **User Education:** Train employees to recognize advanced adversary-in-the-middle phishing pages that attempt to proxy multi-factor authentication challenges in real-time.

**Related:** [Identity Attacks & MFA Bypass: The New Ransomware Entry Point](/blog/identity-attacks-mfa-bypass-the-new-ransomware-entry-point), [ACR Stealer Distributed via Fake Claude AI Desktop Site](/blog/acr-stealer-distributed-via-fake-claude-ai-desktop-site)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/iauthflow-v2-phishing-toolkit-leverages-passkeys-for-persistence