iAuthFlow V2 phishing toolkit can add attacker passkeys to Gmail accounts and survive password resets

Researchers say a phishing toolkit called iAuthFlow V2 can keep access to a victim’s account even after the victim changes their password. Abnormal’s analysis, based on underground sales posts and demos, says the kit relays a victim’s Gmail login through an attacker-controlled browser and silently registers an attacker-controlled passkey, a login credential tied to the account rather than the password, allowing later re-entry via the 'try another way' flow.