New Phishing Toolkit Uses Passkeys to Keep Access After Password Resets

iAuthFlow V2: A new phishing toolkit that leverages passkeys

Security researchers have identified a sophisticated phishing framework called iAuthFlow V2. Unlike classic credential‑theft tools, this kit targets the emerging passkey authentication model. By registering a passkey that the attacker controls, the toolkit can retain access to an account even after the victim updates their password or ends active sessions.

Why passkeys matter in modern authentication

Passkeys are cryptographic credentials that replace passwords with a public‑key pair stored on a device. The private key never leaves the device, and the public key is shared with the service during enrollment. This approach reduces phishing risk because a secret is not transmitted over the network.

Standards such as those published by the FIDO Alliance and guidance from NIST encourage organizations to adopt passkeys for stronger security.

How iAuthFlow V2 subverts the passkey model

The toolkit exploits the enrollment flow that many services expose to users. When a victim clicks a malicious link, the attacker redirects them to a spoofed registration page that mimics the legitimate passkey setup process. The victim believes they are creating a new passkey for their account, but the page actually registers a passkey whose private key is held by the attacker.

Once the attacker‑controlled passkey is linked to the victim’s account, the following conditions apply:

The attacker can authenticate without needing the victim’s password.
Changing the password on the service does not invalidate the registered passkey.
Session revocation mechanisms that target password‑based tokens often ignore passkey tokens.

This persistence gives threat actors a foothold that survives typical remediation steps such as forced password resets.

Technical steps observed in the wild

Phishing email or SMS delivers a link that appears to come from a trusted provider.
User clicks the link and is taken to a cloned passkey enrollment page.
The page forwards the registration request to the legitimate service while injecting the attacker’s public key.
The service records the attacker’s public key as a valid credential for the user’s account.
Attacker uses the corresponding private key to log in at any time.

Researchers who first reported the tool highlighted that the attack works against services that implement the WebAuthn API without additional verification of the enrollment source.

Real‑world impact and reported incidents

Since the public disclosure, security teams have observed several campaigns that combine iAuthFlow V2 with credential‑stuffing attacks. Victims report that even after resetting passwords, they continue to see unauthorized logins from familiar devices. In many cases, the malicious activity is traced back to a passkey that was silently added during the phishing event.

The original report appeared on SecurityWeek, where the researchers described the toolkit’s ability to maintain access despite standard defensive measures.

Defensive strategies for organizations

Mitigating this threat requires a layered approach that goes beyond password policies. Recommended actions include:

Enforce multi‑factor authentication that combines something the user has with something the user knows, even for passkey‑based logins.
Implement enrollment verification, such as sending a confirmation link to the user’s registered email or requiring a secondary approval step.
Monitor for newly added passkeys and flag accounts that receive multiple credential registrations in a short period.
Educate users about phishing tactics that target passkey enrollment flows.
Leverage threat‑intelligence feeds that track iAuthFlow V2 activity.

Some cloud identity providers have already added alerts for suspicious passkey additions. Keeping software libraries up to date and following the latest recommendations from the Microsoft Security Blog can also reduce exposure.

What users can do to protect themselves

Individual users should treat passkey enrollment requests with the same caution they apply to password changes. If an unexpected prompt appears, verify the request by contacting the service directly through an official channel.

Additional steps include:

Review the list of registered security keys in account settings and remove any that are not recognized.
Enable device‑level PIN or biometric protection for the hardware that stores passkeys.
Regularly back up passkeys using trusted password‑manager integrations that support the standard.

By staying vigilant, users can enjoy the benefits of password‑less authentication without exposing themselves to this new class of phishing attacks.