New Phishing Toolkit Uses Passkeys to Maintain Access After Password Resets

The iAuthFlow V2 toolkit exploits a critical gap in account recovery logic: once an attacker gains temporary access, they register an attacker-controlled passkey as a trusted credential, effectively creating a persistent backdoor that survives password resets and session revocations. This matters because many organizations and users treat password resets as a reliable incident response action, assuming it fully evicts an adversary — this toolkit invalidates that assumption. The attack also undermines the perceived security of passkeys, which are increasingly promoted as phishing-resistant, by weaponizing the credential registration process itself. Without visibility into registered authenticators and strict controls over who can add new credentials, defenders may have no idea the attacker is still present.