Google passkey attack exposes credential enrollment weak spot

Adding a passkey should strengthen account security. But new research shows that attackers can exploit the enrollment process to retain access to a Google account even after its password is changed.

Abnormal AI researchers reported that the iAuthFlow v2 toolkit is advertised on a Russian-language cybercrime forum for US$10,000. The toolkit seller shows an operator accessing a Google account through a phished login, registering a separate passkey, and using that credential.

The researchers reviewed the seller’s forum posts, Telegram channel, demonstration videos and a test instance. They did not run the toolkit or independently reproduce the attack.

The demonstration involved a Google account. But the seller also advertises versions targeting Microsoft, iCloud and LinkedIn.

The demonstrated attack depends on two separate browser environments. The target interacts with a page that resembles Google’s sign-in screen, and an attacker-controlled browser communicates with the actual authentication service.

When the target enters an email address, a password, and a code generated by an authenticator app, those details are sent to the attacker-controlled browser. Google processes the information as a legitimate login and establishes an authenticated session.

Although the demonstrated account already had a passkey, the victim authenticated using an authenticator app code instead. That weaker fallback method enabled the phishing attack, allowing the attacker to establish a legitimate Google session.

After obtaining access, the toolkit keeps the target waiting on a verification screen while the attacker-controlled browser opens the account’s passkey settings and registers another credential. Google may require additional identity verification before allowing that change.

The seller’s demonstration shows six seconds between the recorded login and the registration of the new passkey.

The demonstration does not show the attacker stealing the original passkey, private key, or copying a fingerprint or face biometric. The attacker creates a new credential after gaining access to the account via a weaker authentication path.

FIDO Alliance guidance identifies that offering passkeys alongside passwords and one-time codes does not prevent phishing when users can still select the less secure alternative.

Google’s passkey documentation states that newly registered credentials may require a waiting period of up to 7 days before they can be used for sign-in. An older passkey or physical security key may be needed to accelerate the process.

Google also says it can restrict authentication methods that appear to have been added without the account holder’s permission. Its account security guidance explains that users can receive an alert when a suspicious method is detected.

In a separate example of risks surrounding passkey security, Unit 42 researchers showed how malware on compromised Windows devices could exploit device trust mechanisms to access Google synced credentials.

Passkey security depends on the surrounding account infrastructure. Therefore, organizations need to control weaker fallback methods, monitor new credential enrollment, and remove unauthorized passkeys.

Article Topics

biometric authentication  |  biometrics  |  cybersecurity  |  Google  |  passkeys  |  passwordless authentication