Phisher adds a Google passkey after a fake YouTube support email
Original title: The passkey is worse
The victim entered a password and two 2FA codes; attackers then viewed two Drive spreadsheets and deleted the lure.
A blogger describes falling for a YouTube-support phishing email that led to a sites.google.com page imitating Google login. After the password and two-factor codes failed, the page showed a fake Apple passkey prompt and a Bitwarden-style modal matched to the detected password-manager extension. Google later emailed that a new passkey had been added. The author says the intruder deleted the phishing email and opened two financial and crypto-related Google Sheets, with no forwarding rule or mass email observed.
Unconfirmed: The author only theorizes whether the access was for resale or later use and cannot rule out other unseen actions.
- The fake flow detected the browser’s password-manager extension and imitated Bitwarden.
- The author uses a rebranded Bitwarden fork, Saigon Safe, so the modal did not match.
- Access came from an unrecognized device that appeared geographically close.
- Recommended steps include removing the passkey, signing out the device, and checking forwarding.
Impact: Google account access, a new passkey, and viewed Drive files
- 1.Sign the unrecognized device out of the Google account.
- 2.Remove the newly added passkey immediately.
- 3.Recover deleted mail and review Drive access and Gmail forwarding.
From the original article
5 min read at kcoleman.meToday I got a strange email that turned into an unsettling phishing experiences. // If you’re just here to read about how bad passkeys are, skip to part 4 I thought someone from Russia created a support ticket with YouTube to take over my gmail account and I needed to click on their link to reject the support ticket. Oops.
By kcoleman.me via zk · kcoleman.me
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.