iAuthFlow V2 is a high-end phishing toolkit sold on a Russian-language cybercrime forum that can maintain access to a victim’s account even after a password reset. Abnormal’s analysis suggests the toolkit silently registers an attacker-controlled passkey during a phishing flow, making traditional recovery steps insufficient. #iAuthFlowV2 #Abnormal #Google #Gmail #passkeys
Keypoints
- iAuthFlow V2 is a phishing toolkit sold for $10,000 with optional extra modules.
- It was first seen on a Russian-language cybercrime forum.
- The toolkit appears to relay victim interactions to an attacker-controlled remote browser.
- It can silently add a passkey that survives a password reset.
- Abnormal says password resets alone may no longer remove the attacker’s access.