New Phishing Toolkit Uses Passkeys to Maintain Access After Password Resets

iAuthFlow v2 phishing toolkit uses a phished Google session to enroll an attacker-controlled passkey that survives password resets.