Abnormal Security examined the kit's documentation and demonstration videos and reported that the technique uses a browser-in-the-middle model involving two separate browser environments. In a browser-in-the-middle (BitM) attack, the victim completes the login on their own device while a separate browser session on a server relays the interaction. The phishing page impersonates the targeted service, the victim enters credentials, and the server-side browser forwards the input to the genuine site and returns prompts to the victim. The process repeats until authentication succeeds, after which the toolkit maintains an authenticated session. Once authenticated, the kit enrolls an attacker-controlled passkey, a credential that can remain valid after the victim changes their password. The demonstration showed the passkey being created six seconds after authentication. Researchers noted uncertainty about where the attacker's private key is stored, suggesting the kit may use a virtual authenticator that completes registration without persisting the private key on the victim's device. Because the kit has not been purchased or tested, its storage mechanism and broader claims remain unverified. Security analysts recommend that organizations investigate newly registered passkeys, OAuth grants, recovery methods, mailbox filters, and forwarding rules when responding to a compromise, as password resets alone may be insufficient. The rise of passkeys as a phishing-resistant authentication method does not eliminate risks, as attackers can target fallback login methods, active sessions, and other account weaknesses.