Phishing is evolving fast, and a recent analysis points to a worrying possibility: a compromise that can persist even after a user resets their password. The core lesson from this case is captured in the theme passkeys vs phishing—if attackers can steer authentication in the right way, a standard “reset and revoke” response may not fully restore control.
Researchers at Abnormal examined public material about a phishing toolkit called iAuthFlow V2, reportedly marketed for sale in underground cybercrime communities. While Abnormal’s work is based on seller posts and demonstrations rather than verified real-world infection, the described workflow shows how attackers may try to preserve future access by abusing “passkey” authentication behavior.
What the iAuthFlow V2 toolkit was designed to do
According to the available public descriptions, iAuthFlow V2 is a malware/phishing toolkit first spotted in a Russian-language cybercrime forum. Its positioning is that it enables advanced phishing with persistent account access, including surviving a password reset.
The toolkit itself was described as being sold for a base price of $10,000, with additional modules offered separately. Abnormal’s researchers did not acquire or run the malware, but they used information from seller forum content and demonstrations to build an operational analysis.
How the phishing lure works in practice
The scenario starts much like many modern phishing attacks. The victim is tricked into visiting a page that looks legitimate, where the attacker attempts to collect credentials by getting the target to enter them.
At a high level, the attack hinges on two linked browser environments. While the victim interacts with what appears to be a phishing page, the attacker also runs a connected secondary browser session from infrastructure they control. In other words, the responses that authenticate the user are generated by the attacker’s environment rather than by the victim’s device interacting directly with the real service.
For the victim, the compromise can be detected quickly or eventually. Once the victim suspects an issue, a password reset is a common default action—one that typically breaks attacker access when the attacker depends on stolen credentials.
The passkey element that changes the outcome
The described persistence comes from what the attacker secretly adds to the account: a ready-made passkey. Unlike a token derived from a password, a passkey is registered to the account itself as a credential. In the analysis, the passkey is under attacker control.
As the victim proceeds through the phishing page, the toolkit is said to apply a device fingerprint to the victim’s browser. Each interaction is logged, and the authentication flow is relayed to the attacker-controlled second browser environment.
Then, during the sign-in confirmation step, the service requests authentication. In the described behavior, the victim ends up authenticating—unaware that the approval now includes access to an attacker-controlled passkey.
Why password resets may not be enough
When people suspect account compromise, the typical advice is straightforward: change the password and revoke active sessions. Abnormal’s explanation aligns with how major providers generally respond to password changes.
For example, the analysis notes that major services typically revoke app passwords and OAuth tokens with relevant scopes after a password change. Additionally, revoking active sessions should reduce the attacker’s ability to continue using captured session cookies.
However, the described passkey persistence changes the math. Because the attacker’s credential is not merely a token that depends on the password, password reset and token revocation do not necessarily remove that passkey. As a result, the attacker may still be able to “try another way” at login later and authenticate using the stored passkey—without needing to know the original password.
Device fingerprinting and silent recording
Another detail in the analysis is the use of a device fingerprint. By fingerprinting the victim’s browser, the toolkit can maintain a believable and consistent interaction profile as the session proceeds.
At the same time, the toolkit logs each entry from the victim and relays that information into the attacker’s connected environment. This combination—fingerprinting, relaying, and hidden credential registration—aims to make the phishing process more successful and harder to spot.
What is known, and what is still uncertain
It’s important to be careful about what conclusions can be drawn. The Abnormal analysis is based on what was posted publicly by the toolkit seller and on demonstrations shared in that context. The researchers did not verify the behavior by acquiring the malware themselves or running it against accounts.
Other commentary referenced in the reporting describes the toolkit more generally as “phishing-as-a-service” sold to criminals. Some summaries reportedly did not mention passkeys at all, and at least one response was described as confused. That means public understanding of iAuthFlow V2 is incomplete.
Still, even if details differ in real-world use, the described workflow provides a clear illustration of the direction of travel: social engineering is becoming more technical, more interactive, and more able to survive typical recovery steps.
IOC and remediation focus points
Abnormal’s work reportedly includes indicators of compromise (IOCs) and remediation guidance. While the specific IOCs are not reproduced here, the strategic takeaway is clear: a password reset alone may not fully address a phishing-driven account compromise if the attacker managed to register long-lived authentication credentials.
In practical terms, passkeys vs phishing defenses should be designed around the possibility that attackers may add authentication methods during the initial interaction. That means remediation needs to consider not only password and session changes, but also the authentication credentials tied to the account.
Broader implications for account security
This case highlights a subtle risk: as authentication methods improve, attackers will look for new ways to influence the decision points that users experience. Phishing isn’t just about stealing passwords anymore—it can be about shaping what the victim approves during sign-in.
Organizations and users should treat a suspicious sign-in as more than a one-time event. Even if a password reset is performed, attackers may have attempted to establish persistence through alternate credential mechanisms.
Conclusion
The described iAuthFlow V2 scenario underscores why passkeys vs phishing is becoming an important security topic. A password reset and session revocation can reduce risk when attackers rely on passwords, tokens, or stolen cookies—but the analysis suggests persistence may be possible when attackers can register an account-level passkey during the phishing flow.
Even with the caveat that the findings are based on public seller materials, the lesson remains actionable: recovery should go beyond the password, and it should account for authentication credentials that may survive standard remediation steps.
