Phishing Toolkit iAuthFlow V2 Uses Passkeys for Persistence

iAuthFlow V2 registers an attacker-controlled passkey, enabling persistent access after password resets and session revocations. The phishing toolkit exploits passkey authentication to maintain unauthorized entry, according to researchers.