Kevin Coleman describes a sophisticated phishing attack where a fake YouTube support page attempted to steal his Google credentials, then switched to a fraudulent Apple Passkey prompt and a Bitwarden-looking login modal after the 2FA attempts failed. The article highlights how passkey-based phishing remains a significant vulnerability despite passkeys being promoted as more secure than traditional passwords.
Background
Passkeys are emerging as a passwordless authentication alternative promoted by Google, Apple, and Microsoft, but phishing attacks targeting them remain a growing concern. This incident illustrates how attackers are adapting their techniques to exploit even next-gen authentication methods.
- Source
- Lobsters
- Published
- Oct 27, 2026 at 07:44 AM
- Score
- 5.0 / 10