The Phishing Attack That Survives Your Password Reset

A password reset used to be the finish line. You'd spot the phishing email, force a reset, revoke the sessions, and move on. A phishing kit selling for $10,000 on Russian-language cybercrime forums just erased that finish line.

 

Security researchers at Abnormal AI recently detailed a phishing-as-a-service toolkit called iAuthFlow V2 that does something most defenders aren't built to catch: it doesn't just steal a password, it silently registers an attacker-controlled passkey on the victim's account during the phishing interaction. Because passkeys are permanent WebAuthn credentials — not session tokens that expire — resetting the password and killing active sessions leaves the attacker's passkey completely untouched. The attacker simply logs back in later using "try another way" and authenticates with the passkey they planted weeks earlier.

 

That detail is why this story matters more than a typical phishing writeup. iAuthFlow V2 isn't only an email security problem.

 

 

 

The toolkit uses a dual-browser relay: the victim interacts with an attacker-controlled phishing page while the attacker's own browser session, running on their infrastructure, mirrors the login in real time against the real site. As the victim authenticates, the attacker's relay quietly adds a WebAuthn passkey to the account alongside the victim's legitimate login. The victim sees a normal-looking authentication prompt and has no reason to suspect anything happened beyond a routine sign-in.

 

From there, standard incident response playbooks fall short. Forcing a password reset and revoking sessions clears the credential and tokens the responder knows about — but the registered passkey is a separate, durable authenticator that most reset workflows never touch.

 

 

 

iAuthFlow V2 is a sharp new example of a trend the industry's own data has been flagging for a while:

 

 

Put together: attackers are increasingly walking in the front door with valid-looking credentials, and the tools they use to get there are getting cheaper, faster, and better at outliving the response actions defenders count on.

 

 

Most security programs still treat "phishing" and "identity" as separate problem sets — email security tools on one side, IAM and directory services on the other, with limited overlap in monitoring or response. iAuthFlow V2 is built to exploit exactly that seam. The phishing email is the delivery mechanism; the actual compromise lives in the identity layer, in an authenticator that email filtering was never going to catch and that a password-only reset process was never designed to revoke.

 

Closing that seam takes both continuous visibility into what's happening across your identity and access environment, and periodic, adversarial testing to find out whether your response playbooks would actually catch something like this.

 

• 24/7/365 monitoring that includes identity signals. InfoSight's Security Operations Center as a Service (SOCaaS) provides continuous detection, containment, mitigation, and remediation — the kind of always-on visibility needed to flag anomalous authenticator registrations or unusual "alternate sign-in" activity before it becomes a standing backdoor.

• Adversarial testing that goes beyond the password. InfoSight's Penetration Testing services are built to find exactly this kind of gap — where an attacker doesn't need to break in, they just need a credential lifecycle control that nobody stress-tested — before a real attacker finds it first.

• Advisory-level ownership of the response gap. Through our Virtual Security Leadership & GRC service, InfoSight helps organizations without a full-time security executive build (and actually rehearse) incident response and credential-revocation procedures that account for modern authenticators, not just passwords and sessions.

• Baseline visibility into what's exposed. Our Risk and Vulnerability Assessments give you a clear-eyed view of where identity and access controls have drifted from policy, so gaps like an unaudited authenticator registration path get found in an assessment instead of an incident report.

 

 

A password reset is no longer sufficient to fully evict an attacker — and that's not a hypothetical, it's the design principle behind a toolkit currently being sold to criminals for $10,000. Treating phishing defense and identity security as one connected discipline, backed by continuous monitoring and regularly tested response procedures, is what actually closes the door iAuthFlow V2 was built to walk through.

 

Ready to find out if your incident response would catch this?  Talk to InfoSight about a penetration test, a SOCaaS engagement, or a vISO consultation to pressure-test your identity and access controls before someone else does.

 

---