[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fgMrdDaeml9Cwb4gyfDUp6c1WEJTLodcw1rBvvMi9jsA":3},{"article":4,"iocs":41,"watch_terms":42,"solutions":43,"lesson":131},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"7c98fe8e-dce4-4b2c-8b21-1999c5cc38d4","New Phishing Toolkit Uses Passkeys to Maintain Access After Password Resets","new-phishing-toolkit-uses-passkeys-to-maintain-access-after-password-resets-a94f11","Researchers say iAuthFlow V2 can register an attacker-controlled passkey, enabling persistent access even after passwords are changed and active sessions revoked. The post New Phishing Toolkit Uses Passkeys to Maintain Access After Password Resets appeared first on SecurityWeek.","A new phishing toolkit named iAuthFlow V2 has emerged, capable of registering attacker-controlled passkeys to maintain persistent access to victim accounts, even after password resets and session revocations. Researchers analyzed the toolkit, which is sold for $10,000, and found it can bypass standard security measures by adding a passkey as a registered credential, allowing attackers to log in using 'another way' without needing the compromised password.","New phishing toolkit iAuthFlow V2 uses passkeys for persistent account access.","https:\u002F\u002Fwww.securityweek.com\u002Fnew-phishing-toolkit-uses-passkeys-to-maintain-access-after-password-resets\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2025\u002F11\u002FAI-phishing.jpeg","2026-08-21T14:22:06+00:00","2026-08-21T16:00:19.467056+00:00",8,[17,20],{"name":18,"type":19},"Google","vendor",{"name":21,"type":22},"Gmail","product","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":23,"icon":25,"name":26,"slug":27},null,"Malware","malware",[29,34,36],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":35},{"id":23,"icon":25,"name":26,"slug":27},{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[18,21],{"controls":44,"vendors":125},[45,74,100],{"slug":46,"name":47,"problem":48,"products":49},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[50,58,66],{"vendor_slug":51,"vendor_name":52,"vendor_logo":53,"product_slug":54,"product_name":55,"url":56,"description":57},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"slug":75,"name":76,"problem":77,"products":78},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[79,87,95],{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":96,"product_name":97,"url":98,"description":99},"defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"slug":101,"name":102,"problem":103,"products":104},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[105,112,119],{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":106,"product_name":109,"url":110,"description":111},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":101,"product_name":116,"url":117,"description":118},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":120,"product_name":121,"url":123,"description":124},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",[126],{"slug":127,"name":18,"logo_path":128,"roles":129},"google","\u002Fvendor-logos\u002Fgoogle.png",[130],"affected",{"slug":132,"title":133,"body":134,"framework_refs":135,"framework_notes":147},"phishing-toolkit-hijacks-passkeys-to-survive-password-resets","Phishing Toolkit Hijacks Passkeys to Survive Password Resets","The iAuthFlow V2 toolkit exploits a critical gap in account recovery logic: once an attacker gains temporary access, they register an attacker-controlled passkey as a trusted credential, effectively creating a persistent backdoor that survives password resets and session revocations. This matters because many organizations and users treat password resets as a reliable incident response action, assuming it fully evicts an adversary — this toolkit invalidates that assumption. The attack also undermines the perceived security of passkeys, which are increasingly promoted as phishing-resistant, by weaponizing the credential registration process itself. Without visibility into registered authenticators and strict controls over who can add new credentials, defenders may have no idea the attacker is still present.",[136,137,138,139,140,141,142,143,144,145,146],"NIST SP 800-63B Section 6.1 (Authenticator Lifecycle Management)","NIST AC-2 (Account Management)","NIST AC-17 (Remote Access)","NIST IR-4 (Incident Handling)","CIS Control 5 (Account Management)","CIS Control 6 (Access Control Management)","CIS Control 8 (Audit Log Management)","CIS Control 14 (Security Awareness and Skills Training)","MITRE ATT&CK T1556.006 (Modify Authentication Process: Multi-Factor Authentication)","MITRE ATT&CK T1098.005 (Account Manipulation: Device Registration)","GDPR Article 32 (Security of Processing — appropriate technical measures)",{}]