Passkeys and Credential Enrollment

Passkey enrollment becomes a persistence trick: $10,000 kit outlives the password reset

Abnormal says iAuthFlow v2 uses a phished Google session to register an operator-controlled passkey. The standard playbook of revoking sessions and resetting the password does not remove it.