Phishing Toolkit Hijacks Passkeys to Survive Password Resets
Written by AI from the linked story. Not reviewed by an editor. How this works
The iAuthFlow V2 toolkit exploits a critical gap in account recovery logic: once an attacker gains temporary access, they register an attacker-controlled passkey as a trusted credential, effectively creating a persistent backdoor that survives password resets and session revocations. This matters because many organizations and users treat password resets as a reliable incident response action, assuming it fully evicts an adversary — this toolkit invalidates that assumption. The attack also undermines the perceived security of passkeys, which are increasingly promoted as phishing-resistant, by weaponizing the credential registration process itself. Without visibility into registered authenticators and strict controls over who can add new credentials, defenders may have no idea the attacker is still present.
Tactical Insight
Immediate actions
- Audit all registered passkeys, authenticator apps, and trusted devices on high-value accounts and revoke any unrecognized credentials immediately.
- When responding to a suspected account compromise, revoke ALL registered authentication methods — not just passwords and sessions — before re-onboarding the legitimate user.
Long-term improvements
- Enforce admin approval workflows or step-up authentication (e.g., re-authentication + manager approval) before any new passkey or authenticator can be registered to an account.
- Implement conditional access policies that restrict passkey registration to managed, compliant devices only, preventing registration from unknown or untrusted endpoints.
- Educate users and help-desk staff that password resets alone do NOT fully secure a compromised account and that all authentication factors must be reviewed.
Detection measures
- Alert on passkey or authenticator registration events, especially those occurring shortly after login from a new IP, unusual location, or outside business hours.
- Integrate identity provider logs (Entra ID, Okta, Google Workspace) into your SIEM to correlate new credential registrations with phishing indicators or concurrent suspicious session activity.