£8K Phishing Kit Promises to Plant Fake Passkeys and Haunt Compromised Accounts Long After You've Changed Your Password
A phishing kit circulating on Russian-language cybercrime forums claims to solve one of the more frustrating problems in the attacker playbook: getting locked out the moment a victim notices something's wrong.
iAuthFlow v2, priced at around $10,000 for the base package with extra modules sold separately, allegedly lets attackers enroll their own passkey on a compromised account. The idea is simple and nasty. Even after the victim resets their password and revokes sessions, the attacker's passkey sits quietly waiting.
The kit uses a browser-in-the-middle (BitM) approach, which differs slightly from the more familiar man-in-the-middle setup. Two browser environments run in parallel. The victim interacts with what looks like a legitimate Google login page. On the attacker's server, a separate browser handles the actual authentication in real time, relaying prompts back and forth until the login completes successfully.
The demos examined by Abnormal Security focused on Google accounts, though the seller also advertises packages targeting iCloud, LinkedIn, and Microsoft. Once the authentication flow finishes, iAuthFlow v2 has control of a live authenticated session and wastes no time using it.
While the victim stares at a loading screen saying "Verification, Processing," the toolkit is quietly opening the target's Google passkey settings through that authenticated browser and registering a new credential tied to the attacker's device. According to Abnormal's analysis of the seller's recorded demonstration, the whole process took six seconds after authentication completed.
Where exactly the private key gets stored is unclear. Abnormal floated the possibility that the kit uses a Chromium-based virtual authenticator that can complete WebAuthn registration without actually writing anything to the victim's hardware. That would make it significantly harder to detect through standard endpoint checks. But because Abnormal didn't purchase and run the kit themselves, that remains a hypothesis rather than a confirmed finding.
The broader point stands regardless of the technical specifics. Passkeys are frequently promoted as phishing-resistant and more secure than passwords or traditional MFA. That's broadly true in how they function during login. It doesn't mean accounts using passkeys are untouchable.
If an attacker can authenticate as you, even momentarily, they can register their own passkey under your account. Changing your password afterwards does nothing about a credential that doesn't depend on your password. Session revocation helps, but only if it happens before the registration occurs.
There's also the persistent problem of session cookie theft via infostealer malware, which can grant access to an authenticated session without triggering a passkey challenge at all.
For incident responders, the takeaway is that password resets are not recovery. Abnormal recommends treating account restoration as a full investigation: checking for newly registered passkeys, OAuth grants, recovery email or phone changes, Gmail filters, and forwarding rules. Any of these can serve as a persistence mechanism the attacker left behind after you kicked them out the front door.
"Response and recovery cannot end with a password reset or session revocation," Abnormal noted. The toolkit market is clearly moving toward post-authentication persistence as a selling point, which means defenders need to move their mental model in the same direction.