This new malware can use Google passkeys even after a victim resets their password

iAuthFlow v2 sold on Russian forums lets attackers persist in email accounts Tool phishes logins, then secretly creates attacker‑controlled passkeys for lasting access Defenses include auditing passkeys, OAuth tokens, mail rules, and…