This new malware can use Google passkeys even after a victim resets their password

What to do when attackers create passkeys of their own?