[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fch4mE4Tke4YmPWDxDivu-EHCRTnKggyX0vEbH6mRdbI":3},{"article":4,"iocs":54,"watch_terms":62,"solutions":63,"lesson":155},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"d91e0996-aa08-4ff7-95f8-7ff28f2ddfda","Malware Can Abuse Windows Hello for Business Keys for Persistent Entra ID Access","malware-can-abuse-windows-hello-for-business-keys-for-persistent-entra-id-access-2749aa","Security researcher Malcolm Stagg has disclosed a new attack class called NatJack that manipulates network address translation (NAT) connection state to hijack active TCP sessions, spoof DNS responses, disclose victim IP addresses and mapped ports, and exhaust NAT tables. Presented at Black Hat USA 2026, Stagg said the techniques were demonstrated across network infrastructure devices","A security researcher has demonstrated a new technique where malware running in a signed-in Windows session can silently use the victim's Windows Hello for Business key to authenticate to Microsoft Entra ID. This allows attackers to establish long-term cloud access, register their own devices, and obtain Primary Refresh Tokens (PRTs) without needing administrator privileges or extracting private keys, even on TPM-backed systems. The technique leverages the WebAuthn protocol to treat the Windows Hello for Business key as a FIDO2 passkey, bypassing certain security checks and potentially satisfying phishing-resistant authentication requirements.","Malware can abuse Windows Hello for Business keys to gain persistent Entra ID access.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002Fmalware-can-abuse-windows-hello-for.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEj81b6_YckjrqqfRrJQNRdIf3nu4xfqLNScukFYEao4VeF5QNlt16sbEwrdutizdB9Q1nOWRQpqeSZg4gYZsL8cIhRSJ43XJqMKWKgdKF28oeTl19HQQ75dnOKVHsa6DtXr4zhlmIF43nbUWV5jyEh4D1TjIvBKjgoAX2MpUbjJH3cN4hd4zDvIu_t4Jec\u002Fs1600\u002Fwindows-hello-keys.jpg","2026-08-07T08:52:11+00:00","2026-08-07T10:00:19.083668+00:00",8,[17,20,22,25,27,29],{"name":18,"type":19},"Windows Hello for Business","product",{"name":21,"type":19},"Microsoft Entra ID",{"name":23,"type":24},"WebAuthn","technology",{"name":26,"type":24},"FIDO2",{"name":28,"type":24},"TPM",{"name":30,"type":19},"ROADtools","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,42,44,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,59],{"type":56,"value":57,"context":58},"url","https:\u002F\u002Fgithub.com\u002FNetSPI\u002FROADtools\u002Fblob\u002Fmain\u002FROADtools\u002FSecurity\u002Ffido_assertion.ps1","Proof-of-concept script for invoking Windows Hello for Business keys.",{"type":56,"value":60,"context":61},"https:\u002F\u002Fgithub.com\u002FNetSPI\u002FROADtools\u002Fblob\u002Fmain\u002FROADtools\u002FSecurity\u002Fhellopoc.ps1","Proof-of-concept script for Windows Hello for Business key abuse.",[18,21,30],{"controls":64,"vendors":148},[65,93,122],{"slug":66,"name":67,"problem":68,"products":69},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[70,78,85],{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":66,"product_name":82,"url":83,"description":84},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"slug":94,"name":95,"problem":96,"products":97},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[98,106,114],{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"slug":123,"name":124,"problem":125,"products":126},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[127,135,140],{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":136,"product_name":137,"url":138,"description":139},"managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":141,"vendor_name":142,"vendor_logo":143,"product_slug":144,"product_name":145,"url":146,"description":147},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",[149],{"slug":150,"name":151,"logo_path":152,"roles":153},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[154],"affected",{"slug":156,"title":157,"body":158,"framework_refs":159,"framework_notes":172},"malware-hijacks-windows-hello-keys-for-stealthy-entra-id-persistence","Malware Hijacks Windows Hello Keys for Stealthy Entra ID Persistence","This attack demonstrates that even phishing-resistant authentication mechanisms like Windows Hello for Business can be abused by malware already present in an active user session, without requiring admin privileges or TPM key extraction. By leveraging the WebAuthn\u002FFIDO2 protocol, attackers can silently authenticate to Microsoft Entra ID, register rogue devices, and obtain Primary Refresh Tokens (PRTs) that grant long-term cloud access. This matters because organizations may have a false sense of security believing hardware-backed MFA fully prevents post-compromise lateral movement to cloud resources. The attack highlights that endpoint compromise effectively undermines cloud identity trust boundaries, even when modern passwordless authentication is in place. Persistent cloud access via registered attacker devices is particularly dangerous as it can survive password resets and traditional remediation steps.",[160,161,162,163,164,165,166,167,168,169,170,171],"CIS Control 5 - Account Management","CIS Control 6 - Access Control Management","CIS Control 13 - Network Monitoring and Defense","NIST SP 800-63B - Digital Identity Guidelines (AAL3)","NIST AC-2 - Account Management","NIST AC-17 - Remote Access","NIST SI-3 - Malicious Code Protection","NIST IA-5 - Authenticator Management","MITRE ATT&CK T1098.005 - Account Manipulation: Device Registration","MITRE ATT&CK T1556 - Modify Authentication Process","Microsoft Secure Score - Restrict user consent and device registration","GDPR Article 32 - Security of Processing (integrity of authentication systems)",{}]