Malware Can Abuse Windows Hello for Business Keys for Persistent Entra ID Access
Malware can abuse Windows Hello for Business keys to gain persistent Entra ID access.
A security researcher has demonstrated a new technique where malware running in a signed-in Windows session can silently use the victim's Windows Hello for Business key to authenticate to Microsoft Entra ID. This allows attackers to establish long-term cloud access, register their own devices, and obtain Primary Refresh Tokens (PRTs) without needing administrator privileges or extracting private keys, even on TPM-backed systems. The technique leverages the WebAuthn protocol to treat the Windows Hello for Business key as a FIDO2 passkey, bypassing certain security checks and potentially satisfying phishing-resistant authentication requirements.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Windows Hello for Business?
Get an email when a new story names Windows Hello for Business, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThis attack demonstrates that even phishing-resistant authentication mechanisms like Windows Hello for Business can be abused by malware already present in an active user session, without requiring admin privileges or TPM key extraction. By leveraging the WebAuthn/FIDO2 protocol, attackers can silently authenticate to Microsoft Entra ID, register rogue devices, and obtain Primary Refresh Tokens (PRTs) that grant long-term cloud access. This matters because organizations may have a false sense of security believing hardware-backed MFA fully prevents post-compromise lateral movement to cloud resources. The attack highlights that endpoint compromise effectively undermines cloud identity trust boundaries, even when modern passwordless authentication is in place. Persistent cloud access via registered attacker devices is particularly dangerous as it can survive password resets and traditional remediation steps.
What helps against this
How we list vendors
- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- url — https://github.com/NetSPI/ROADtools/blob/main/ROADtools/Security/fido_assertion.ps1
- url — https://github.com/NetSPI/ROADtools/blob/main/ROADtools/Security/hellopoc.ps1