Malware Can Abuse Windows Hello for Business Keys for Persistent Entra ID Access

Security researcher Dirk-jan Mollema has revealed a post-exploitation technique that allows malware running inside an authenticated Windows session to silently leverage the victim's Windows Hello for Business key and forge cloud access via Microsoft Entra ID. Demonstrated earlier this week and first surfaced at DEF CON 32 in 2024, the attack does not require admin privileges, PIN recovery, or biometric interaction on TPM-backed devices. Instead, it relies on Windows' native ticketing mechanism, which keeps private-key operations available to any process running as the signed-in user while a session remains interactive. That means a single piece of malware with ordinary user-level code execution can ask Windows to sign authentication data on the user's behalf.

The new variant removes the previously documented requirement of having access to an Entra-registered or joined device. Mollema found that the five-minute Entra ID authentication challenge is unbound from any specific session, user, or tenant, so an attacker can request it on a separate host and have the compromised endpoint produce the signed assertion. By treating the Windows Hello for Business key as a FIDO2 passkey through WebAuthn, the assertion can be fed into ROADtools to request tokens or launch a browser session fully impersonating the victim. Critically, the resulting token carries no device ID claim, which allows the attacker to register a freshly attacker-controlled device, request a Primary Refresh Token (PRT) for it, and move laterally into Microsoft cloud services. Admins worried about credential exposure can verify whether employees reuse risky logins with the password checker and inspect enterprise endpoints for anomalies using the port scanner.

A PRT issued this way remains valid for 90 days and is renewed automatically while the device stays active, granting long-term persistence into services such as Exchange Online, SharePoint, and Azure. Mollema also confirmed that the WebAuthn-based sign-in satisfies Conditional Access policies demanding Microsoft's phishing-resistant authentication strength, and counts as fresh multi-factor authentication. Where tenant policies allow, attackers can then enroll additional passkeys or Windows Hello for Business credentials on the rogue device. The disclosure does not specify which Windows builds or WHfB deployment models were tested, and as of August 6, 2026, no CVE or Microsoft advisory has been published in Microsoft's Security Update Guide, NVD, or CVE.org. The Hacker News has reached out to both Microsoft and Mollema for comment, but no responses had been published at the time of reporting.

Microsoft documents the underlying ticketing behavior by design and Mollema describes the result as an intentional consequence of how Windows Hello for Business functions. There is no evidence yet of active exploitation or identified victims, but defenders should treat any authenticated Windows endpoint as a potential launch point for Entra ID persistence. Recommended mitigations include alerting on unexpected or out-of-band device registrations, tightening Conditional Access with device-state and compliance policies that break the chain before a PRT is issued, and monitoring for ROADtools or WebAuthn-driven logon activity originating from unapproved hosts. Organizations should also run a broader privacy checkup across managed identities and audit recent MFA method additions for signs of unauthorized enrollment.