iAuthFlow v2: The $10,000 Phishing Toolkit That Survives Your Password Reset
Abnormal Security details iAuthFlow v2, a $10,000 phishing kit that enrolls attacker-controlled passkeys on Google accounts, persisting through password resets.
Abnormal Security analyzed iAuthFlow v2, a phishing toolkit sold on a Russian-language cybercrime forum for a $10,000 base price with additional capability modules sold separately. Using a browser-in-the-middle relay behind a trycloudflare.com subdomain with valid TLS, it captures Google logins and uses the authenticated session to enroll an attacker-controlled passkey within six seconds of login. Because the passkey persists after password changes and session revocation, operators regain mailbox access even after victims reset credentials. The build examined targets Google, while the seller advertises versions for Microsoft, iCloud, and LinkedIn.
- Browser-in-the-middle relay proxies the real Google login, capturing email, password, and 2FA codes.
- Passkey enrollment completed in six seconds during the seller's recorded demonstration.
- Password reset kills sessions and OAuth tokens but does not remove attacker-enrolled passkeys.
- Remediation requires auditing passkeys, Gmail filters, delegated access, OAuth grants, and recovery settings.
- ATT&CK
- T1566.002 Spearphishing LinkT1557 Adversary-in-the-MiddleT1098.005 Account Manipulation: Device Registration
- Vendors
- Abnormal Security
- Products
- GoogleGoogle WorkspaceChromium
- Malware
- iAuthFlow v2
- Organizations
- Abnormal Security
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | trycloudflare.com | henticated session. In the demo, the fake login page used a trycloudflare.com subdomain, giving the link a valid TLS certificate and a mo |
From the original article
4 min read at securityaffairs.com
iAuthFlow v2 phishing toolkit uses a phished Google session to enroll an attacker-controlled passkey that survives password resets. Abnormal Security researchers have published an analysis of iAuthFlow v2, a phishing toolkit sold on a Russian-language cybercrime forum for $10,000 base price. The author also offers for sale additional capability modules separately.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.