SecurityWeek
New Phishing Toolkit Uses Passkeys to Maintain Access After Password Resets
Researchers discovered iAuthFlow V2, a phishing toolkit that registers attacker-controlled passkeys to maintain persistent access even after victims reset passwords or revoke active sessions. This represents a novel persistence mechanism that bypasses traditional account recovery measures.
AI summary · generated with Claude