Passkey enrollment shortly after suspicious Google sign-in (iAuthFlow V2)

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•2

Detects potential session hijacking where a user logs into Google Workspace from a new IP or country, followed within an hour by the registration of a new security key or passkey, which is a common technique to establish persistent unauthorized access.