iAuthFlow V2 is a commercial phishing toolkit first observed on Russian-language cybercrime forums. It targets victims by phishing credentials and silently registering an attacker-controlled passkey on the victim's account. This passkey acts as a persistent credential that survives password resets and session revocations, which are standard responses to phishing compromises. The attacker uses a separate browser environment to interact with the victim's authentication flow, relaying inputs and responses to maintain stealth and persistence. The analysis is based on publicly available seller posts and research by Abnormal Security, without direct malware execution. This technique exploits the fact that passkeys are registered credentials independent of passwords, allowing attackers to regain access by selecting alternative login methods. The existence of iAuthFlow V2 highlights the increasing sophistication of social engineering and phishing attacks.

The primary impact is that attackers can maintain persistent unauthorized access to victim accounts even after victims perform password resets and revoke active sessions. This undermines the effectiveness of standard incident response actions following phishing compromises. The attacker-controlled passkey credential allows bypassing password-based authentication, enabling continued account access without needing the victim's password. This increases the risk of prolonged account compromise, data theft, and potential further exploitation of the victim's account.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Standard password resets and session revocations do not remove attacker-registered passkeys. Organizations and users should review and manage registered passkeys and other authentication credentials associated with their accounts. Monitoring for suspicious passkey registrations and using multi-factor authentication methods that include user verification steps for credential registration may help mitigate risk. Awareness and training to recognize phishing attempts remain critical. Follow vendor and security community advisories for updates on detection and remediation specific to this threat.