iAuthFlow v2 malware adds attacker passkeys to hijacked email accounts

AI digestMimile.ai EditorialAugust 21, 2026 at 08:05 PM

This digest was compiled by AI from multiple sources — links to the originals are below.

iAuthFlow v2 malware adds attacker passkeys to hijacked email accounts

Security researchers at Abnormal discovered iAuthFlow v2, a malware toolkit sold on Russian forums for over $10,000 that lets attackers regain access to compromised email accounts even after password resets. The tool phishes credentials from Google, Microsoft, iCloud, or LinkedIn, then silently creates an attacker-controlled passkey. Abnormal advises users to audit passkeys, OAuth tokens, mail rules, and remove rogue authentication methods.

Key Facts

iAuthFlow v2 is sold on Russian dark web forums for over $10,000.
The malware targets Google, Microsoft, iCloud, and LinkedIn login pages.
After phishing credentials, iAuthFlow v2 creates an attacker-controlled passkey in about six seconds.
Abnormal recommends reviewing unauthorized passkeys, OAuth tokens, mail rules, and recovery settings.

Malware Operation

iAuthFlow v2 is sold on Russian dark web forums for over $10,000, according to Abnormal. The toolkit phishes login credentials from Google, Microsoft, iCloud, and LinkedIn. After the victim enters credentials, the tool displays a processing page while it creates a new passkey in the background. A demo video shows the passkey being created six seconds after authentication.

Defense Measures

Abnormal advises users to review accounts for unauthorized passkeys, security keys, Gmail filters, and forwarding rules. Users should revoke relevant OAuth tokens and grants. Organizations should investigate sign-in, mail-rule, 2-Step Verification, passkey, and OAuth audit events. Any attacker-enrolled authentication methods must be removed.

1 source

iAuthFlow v2 malware adds attacker passkeys to hijacked email accounts

techradar.com

TechRadar

Technology

Chrome Passkey Theft Possible Without User Prompt, Research Shows

Palo Alto Networks Unit 42 released a technical analysis on August 3 detailing three methods that let malware on a compromised Windows machine silently steal and reuse passkeys from Chrome’s Google Password Manager. The Pass-ta-key, Silver Pass-ta-key, and Golden Pass-ta-key techniques exploit gaps in how Chrome stores device keys and handles re-enrollment, enabling attackers to obtain valid authentication assertions without triggering a fingerprint or PIN prompt. The research noted that none of the attacks break passkey cryptography, highlighting implementation flaws rather than protocol weaknesses.

Technology

Red Hat patches critical Keycloak flaw enabling unauthenticated account takeover

Red Hat and the Keycloak project released patches for CVE-2026-18963, a critical flaw rated 9.1 that lets unauthenticated attackers reset any user's password. The vulnerability stems from improper state validation in the reset-credentials flow, allowing account takeover without user interaction. No exploitation has been detected as of August 24, 2026.

Technology

SpecterOps to unveil passkey flaws at Black Hat USA

SpecterOps researchers will present three zero-day vulnerabilities in Microsoft's passkey implementation at Black Hat USA next month in Las Vegas. The flaws could allow attackers to impersonate privileged cloud identities by replaying authentication credentials.

Technology

CrowdStrike finds worm targeting AI software supply chain

CrowdStrike researchers discovered a worm that targets AI software supply chains, stealing credentials and sensitive data while evading detection. The malware mimics legitimate AI coding activity, making it difficult to identify. The attack reflects a growing trend of adversaries exploiting AI toolchains.

iAuthFlow v2 malware adds attacker passkeys to hijacked email accounts

Key Facts

Malware Operation

Defense Measures

Read more

Read more