Malware News This new malware can use Google passkeys even after a victim resets their password

[Brownie2019]

Content source

https://www.techradar.com/pro/security/this-new-malware-can-use-google-passkeys-even-after-a-victim-resets-their-password

What to do when attackers create passkeys of their own?

• iAuthFlow v2 sold on Russian forums lets attackers persist in email accounts
• Tool phishes logins, then secretly creates attacker‑controlled passkeys for lasting access
• Defenses include auditing passkeys, OAuth tokens, mail rules, and removing rogue methods

Security researchers have discovered a new malware toolkit which allows threat actors to log back into compromised email accounts even after the password was changed and all sessions terminated.

iAuthFlow v2 is currently being sold on Russian dark web forums for north of $10,000, a new report from cybersecurity experts from Abnormal said, as they obtained a copy of iAuthFlow v2 for analysis.

The malware primarily works as a phishing tool, trying to trick users into logging into either Google, Microsoft, iCloud, or LinkedIn. As soon as they do that, they relay the login credentials to the attackers, who log into the accounts on their end, as well - before the tool displays a “processing” page for a few seconds while, in the background, it sets up a new passkey.
How to defend against iAuthFlow v2
A passkey is an alternative means of authentication that is often touted as the “password killer”. It uses cryptographic keys stored on a device, allowing users to sign in with a fingerprint, face scan, or device PIN.

Because the secret key never leaves the device, it is resistant to phishing. However, if the threat actor is able to generate a key of their own, on the device they own, access is basically guaranteed.
The ad for the toolkit also comes with a video demo, showing how it works. In the demo, iAuthFlow v2 created the passkey six seconds after authentication.

However, generating a passkey is not that straightforward of a process and it could encounter hiccups, Abnormal hints, saying that Google, for example, might require further identity verification before allowing the change.
Usually, when a threat actor compromises an email account, terminating all sessions and changing the password is usually enough.

In this case, however, users should do a lot more: review the account for signs of compromise, including unauthorized passkeys or security keys, malicious Gmail filters and forwarding rules, recovery and delegated access changes, and unauthorized applications, Abnormal suggests.

They should also revoke relevant OAuth tokens and grants, investigate available sign-in, mail-rule, 2-Step Verification, passkey and OAuth audit events, and finally, make sure any attacker-enrolled authentication methods are removed.

 

[Bot]

What this means

Changing the password and terminating active sessions may not be sufficient if an attacker has added their own passkey, security key, recovery method, OAuth authorization, mail rule, or delegated access. These mechanisms can provide an independent way back into the account.

A passkey created by an attacker is not normally removed by changing the password. It must be identified and deleted from the account’s authentication settings. The attacker’s device does not need to be physically present after enrollment because the account retains the public key associated with that passkey.

Recommended response

Use a known-clean device and, if possible, a trusted network. Then:

• Change the password to a unique password and confirm that the recovery email address and telephone number are yours.
• Review and remove unknown passkeys, security keys, authenticator-app enrollments, and other two-step verification methods.
• Terminate all sessions and revoke unfamiliar OAuth applications, app passwords, refresh tokens, and connected devices.
• Check mailbox forwarding, filters, rules, delegates, send-as permissions, and automatic replies for unauthorized changes.
• Review sign-in history and security-event logs for unfamiliar locations, devices, IP addresses, and authentication methods.
• Inspect sent mail, deleted mail, drafts, and account recovery activity for evidence of abuse.
• After cleanup, enable phishing-resistant MFA such as a passkey or hardware security key that you personally control.

For a work or school account, the organization’s administrator should also check identity-provider audit logs, reset or revoke sessions centrally, remove unauthorized authentication methods, review mailbox audit events, and investigate related accounts. Removing only the visible passkey may not be enough if the attacker also registered an OAuth application or changed recovery information.

Do not assume that an unfamiliar passkey is malicious solely from its name; verify the enrollment time, device details, and related sign-in events where the provider makes those available. If account ownership or cleanup is uncertain, use the provider’s official account-recovery process and involve the organization’s security team. The key point is to audit every persistence mechanism, not just the password and active sessions.

 

[TairikuOkami]

Passkey is the worst thing ever created, it's purpose is convenience, not security. It basically turned 2FA into 1.5FA, better than using just a password, but worse than using 2FA.