Passkeys at risk: The malware that bypasses password changes

The illusion of security: iAuthFlow v2 and the end of absolute invulnerability

Over the last decade, the tech industry has waged a fierce battle against the weakest link in computer security: the password. The adoption of passkeys, backed by giants like Google, Apple, and Microsoft under the FIDO2 standard, was presented as the ultimate panacea. By eliminating the reliance on memorizable character strings and replacing them with locally stored cryptographic key pairs, traditional phishing seemed destined for obsolescence. However, the recent discovery of the iAuthFlow v2 toolkit, analyzed exhaustively by researchers at Abnormal Security, has dismantled this narrative of invulnerability, proving that technical architecture, no matter how robust, is vulnerable to advanced social engineering.

Marketed on Russian-language underground forums for a price exceeding $10,000, iAuthFlow v2 is not a simple phishing script; it is a comprehensive attack platform designed for persistent identity hijacking. Its emergence marks a turning point comparable to the rise of the first AitM (Adversary-in-the-Middle) kits that began challenging SMS-based two-factor authentication (2FA) years ago. While previous attacks focused on intercepting temporary tokens, iAuthFlow v2 raises the stakes by subverting the very trust mechanism that was supposed to replace passwords.

How does this threat operate?

The sophistication of iAuthFlow v2 lies in its real-time execution capability and its impeccable mimicry. The attack flow begins by redirecting the victim to a spoofed login page that replicates the interfaces of critical services like Google, Microsoft, iCloud, or LinkedIn with millimeter precision. Unlike mass phishing campaigns, this malware operates with surgical precision.

When the user enters their credentials, the toolkit does not simply capture them. It acts as a transparent bridge (proxy) between the victim and the legitimate service. While the user is held on a 'processing' or 'verification' screen—a psychological trick designed to gain vital seconds—the attacker uses the newly obtained credentials to log in to a real instance of the service. In that brief interval, the malware automates the creation of its own passkey on the compromised account. According to laboratory tests conducted by Abnormal, this process can be completed in just six seconds. By registering its own cryptographic key, the attacker grants themselves top-level access that is indistinguishable from a legitimate user device, achieving persistence that survives any subsequent password change.

Why is changing the password no longer enough?

Historically, the standard response to a suspected intrusion was immediate: change the password and sign out of all active sessions. This strategy was based on the premise that the attacker only possessed a temporary key. With iAuthFlow v2, this logic is obsolete. By injecting a malicious passkey, the attacker is not simply 'using' the account, but is redefining the authorized authentication methods for the profile.

From a technical perspective, this is a cryptographic 'backdoor.' Even if the user resets their password, the attacker can authenticate using their registered passkey, which is recognized by the system as a higher-level trusted credential. This phenomenon underscores a systemic risk: delegating security to physical or biometric devices can backfire if the initial registration process (onboarding) is not strictly monitored by identity providers. Although platforms like Google have implemented additional friction—requiring secondary verifications to register new security methods—the effectiveness of these measures varies depending on the user's configuration and the attacker's cunning in bypassing risk controls.

Defense and mitigation strategies

The emergence of iAuthFlow v2 forces us to change our mindset: digital security can no longer be a passive state, but a constant audit. Given this scenario, it is imperative that companies and users adopt a 'Zero Trust' approach to their own identity management:

• Comprehensive authentication method audit: It is vital to periodically review the list of authorized devices and security keys in the security settings panels of Google, Microsoft, or Apple. Any device or passkey that is not immediately recognizable must be revoked without delay.
• OAuth and permission control: Attackers often maintain persistence through third-party application access tokens. Revoking unnecessary permissions for applications that are not actively used is a fundamental digital hygiene measure.
• Monitoring automation rules: Many attackers, after securing access, configure email forwarding rules or filters to hide security alerts and monitor communications. Reviewing email rule configurations is essential to detect persistent intrusions.
• Recovery verification: Attackers often modify recovery emails or phone numbers. Ensuring that this data has not been altered is the last bastion against permanent account hijacking.

Although passkey technology remains inherently superior to static passwords, the lesson of iAuthFlow v2 is clear: the human link remains the most exploitable attack vector. Digital security, in the age of AI and automated malware, requires active vigilance and a deep understanding of how access privileges are managed in our digital lives.