Malware Can Abuse Windows Hello for Business Keys for Persistent Entra ID Access

Summary

A security researcher has demonstrated a new technique where malware running in a signed-in Windows session can silently use the victim's Windows Hello for Business key to authenticate to Microsoft Entra ID. This allows attackers to establish long-term cloud access, register their own devices, and obtain Primary Refresh Tokens (PRTs) without needing administrator privileges or extracting private keys, even on TPM-backed systems. The technique leverages the WebAuthn protocol to treat the Windows Hello for Business key as a FIDO2 passkey, bypassing certain security checks and potentially satisfying phishing-resistant authentication requirements.

Full text

Malware Can Abuse Windows Hello for Business Keys for Persistent Entra ID Access Swati KhandelwalAug 07, 2026Endpoint Security / Vulnerability Entra ID researcher Dirk-jan Mollema demonstrated that malware already running in a signed-in Windows session can silently use the victim's Windows Hello for Business key to authenticate to Microsoft Entra ID. The attacker can then establish longer-term cloud access, register a device it controls, obtain a Primary Refresh Token (PRT), and add further authentication methods where tenant policies permit. On TPM-backed systems, the attacker does not extract the private key, recover the PIN, or trigger a biometric prompt. Windows ticketing keeps private-key operations available while the user is interactively signed in, allowing code running as the user to ask Windows to sign authentication data. Administrator privileges are not required. The technique requires code execution in the victim's signed-in session. Mollema describes the behavior as a consequence of how Windows Hello for Business works and says it was left as-is. The disclosure does not report active exploitation or victims. Mollema recommends monitoring unexpected device registrations. The disclosure does not identify the exact Windows builds or Windows Hello for Business deployment models tested. The Hacker News found no CVE or Microsoft advisory tied to the technique in searches of Microsoft's Security Update Guide, NVD, and CVE.org as of August 6, 2026. The Hacker News has contacted Microsoft and Mollema; replies are pending. Microsoft documents the ticketing behavior. Mollema said the ability to invoke Windows Hello for Business keys from a compromised session was presented at DEF CON 32 in 2024. That method could produce a signed assertion for a PRT, but also required access to an Entra-registered or joined device. The new work removes that requirement by treating the Windows Hello for Business key as a FIDO2 passkey through WebAuthn. Mollema found that the five-minute Entra ID challenge is not bound to a session, user, or tenant. An attacker can therefore request it on another host and have the compromised endpoint produce the signed assertion. ROADtools, a framework for interacting with Entra ID, can use the assertion to request tokens or open a browser session as the victim. Mollema found that the token carries no device ID claim. A token without that device binding lets the attacker register a new device, request a PRT for it, and reach Microsoft cloud services. Microsoft documents that a PRT remains valid for 90 days and is continuously renewed while the user actively uses the device. Mollema found that the WebAuthn sign-in can satisfy Conditional Access policies requiring Microsoft's phishing-resistant authentication strength. He said the sign-in also counts as fresh multi-factor authentication, allowing an attacker to add passkeys or Windows Hello for Business keys on the new device where policies allow. Separate device-state or compliance policies can still interrupt the chain, so the complete persistence route will not work in every deployment. The finding exposes a limit of phishing-resistant authentication: the credential can remain hardware-bound and unexported while malware inside the signed-in endpoint session invokes it for the attacker. Mollema published the PowerShell proof-of-concept scripts in the ROADtools repository. The Hacker News found fido_assertion.ps1 and hellopoc.ps1 in the folder on August 6, 2026. For detection, he recommended hunting for Windows Hello for Business sign-ins with an empty device ID. Legitimate incognito or non-SSO browser sessions can produce the same pattern. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  Access Management, Authentication, Cloud security, cybersecurity, endpoint security, enterprise security, Identity Security, Microsoft, Vulnerability, Zero Trust ⚡ Top Stories This Week New Bit2Watt Attack Could Let Cloud Tenants Disrupt Power Grids Without an Exploit Open-Source Android AI Agents Could Let Invisible Screen Text Run Code on Host PCs Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code Apple Fixes Hide My Email Bug That Exposed Real Addresses in Mail Logs Microsoft Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Review Agents OpenAI Says Its AI Models Escaped Sandbox, Targeted Hugging Face to Cheat Benchmark Adobe Acrobat Extension Flaw Let Malicious Sites Read WhatsApp Web Data Ubuntu snap-confine Flaw Could Give Local Users Root on Default Desktop Installs Nine-Year-Old RefluXFS Linux Flaw Gives Local Users Root on Default RHEL Installs Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers Claude Cowork Flaw Could Let AI Agent Escape Its VM and Access Mac Files ThreatsDay: Android Spyware, PLC Attacks, AI Image Prompt Injection + 12 More Stories Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable ⭐ Featured Resources [Webinar] How Militaries Can Trust the Data Behind Autonomous Missions Download the 5-Step Action Plan for AI-Speed Exploitation Get the Checklist for Gaining Control of AI Use Across Your Organization Get the 2026 CISO Benchmark Report Based on 600 Security Leaders

Indicators of Compromise

• url — https://github.com/NetSPI/ROADtools/blob/main/ROADtools/Security/fido_assertion.ps1
• url — https://github.com/NetSPI/ROADtools/blob/main/ROADtools/Security/hellopoc.ps1

Entities