iAuthFlow V2 May Use Passkeys to Retain Gmail Access After Password Resets

Summary

Abnormal researchers say iAuthFlow V2 may relay phishing authentication through an attacker-controlled browser and register a passkey, potentially preserving Gmail access after password resets. Their analysis is based on seller material, not malware testing.

Key points

Abnormal researchers reconstructed the toolkit's possible operation from seller forum posts and demonstrations; they did not acquire or run it.
In the described attack, credentials and authentication responses entered on a phishing page are relayed to a separate browser environment controlled by the attacker.
The analysis says the toolkit silently registers an attacker-controlled passkey during the victim's authentication.
A password reset and session revocation may not remove that passkey, which could allow later account access without the password.
Public information about iAuthFlow V2 is limited, and the article notes that other descriptions do not mention its passkey capability.

Article Details

Attack Vectors: Phishing through an attacker-controlled webpage that captures the victim’s credentials and authentication responses.
Relaying the victim’s interactions to a separate browser environment on the attacker’s server.
Silently registering an attacker-controlled passkey on the victim’s account, which can remain usable after a password reset and session revocation.
Defensive Notes: A password reset and session revocation may not remove an attacker-registered passkey; check the account’s registered passkeys and remove any unauthorized credential.
Abnormal’s analysis is based on the toolkit seller’s online posts and demonstrations, not on acquiring or running the malware; the article says little is publicly known about iAuthFlow V2.