SecurityThe Registerabout 4 hours ago
$10K phishing kit plants rogue passkeys
3 min read
A $10,000 phishing kit sold on Russian-language forums, iAuthFlow v2, enrolls attacker-controlled passkeys on compromised accounts for persistent access after password changes. The browser-in-the-middle attack targets Google, iCloud, LinkedIn, and Microsoft, creating a passkey six seconds after authentication. Abnormal Security examined the kit's documentation and demos.
Level
Hype check
Tap to vote and see what everyone thinks.
Summary by ByteBrief
