$10K phishing kit claims it can plant rogue passkeys for persistent access to pwned accounts
- ID
- 16470
- Status
- summarized
- Published
- 21 Aug 2026, 8:18 PM
- Fetched
- 21 Aug 2026, 11:39 PM
- Provider
- The Register
- Category
- technology
- Original URL
- https://www.theregister.com/cyber-crime/2026/08/21/10k-phishing-kit-claims-it-can-plant-rogue-passkeys-for-persistent-access-to-pwned-accounts/5291006
- Source URL
- https://www.theregister.com/headlines.atom
Summary
- Score
- 7.5
- Created
- 21 Aug 2026, 11:41 PM
- Tags
- Audience
- developerssaas_founders
What happened
A $10,000 phishing kit called iAuthFlow v2, sold on Russian-language cybercrime forums, uses a browser-in-the-middle attack to enroll attacker-controlled passkeys on compromised accounts within seconds of authentication. Abnormal Security analyzed the kit's demos showing it targeting Google, with packages also advertised for iCloud, LinkedIn, and Microsoft. The rogue passkey persists even after the victim changes their password, defeating standard remediation steps like session revocation and credential rotation.
Why it matters
If you ship passkey-based auth, this kit exposes a gap in enrollment flows: after a successful BitM phishing attack, the attacker can register their own passkey before the victim notices. You should require step-up re-authentication or a verified device challenge before allowing new passkey enrollment, and push real-time alerts to users when a new passkey is added. Standard password rotation and session revocation are no longer sufficient remediation if a rogue passkey is already enrolled.
Discussion angle
How should auth systems handle passkey enrollment to prevent rogue credentials — is step-up verification enough, or do we need out-of-band confirmation before a new passkey goes live?