High cybersecurity update: Malware Can Abuse Windows Hello for Business Keys for Persistent Entra ID Access. NetworkFix reviewed the available source material to summarize the security issue, its potential impact and the defensive actions administrators should prioritize.
What Happened
Entra ID researcher Dirk-jan Mollema demonstrated that malware already running in a signed-in Windows session can silently use the victim's Windows Hello for Business key to authenticate to Microsoft Entra ID. The attacker can then establish longer-term cloud access, register a device it controls, obtain a Primary Refresh Token (PRT), and add further authentication methods where tenant policies Malware Can Abuse Windows Hello for Business Keys for Persistent Entra ID Access Reach out to get featured—contact us to send your exclusive story idea, research, hacks, or ask us a question or leave a comment/feedback! Swati Khandelwal Aug 07, 2026 Endpoint Security / Vulnerability Entra ID researcher Dirk-jan Mollema demonstrated that malware already running in a signed-in Windows session can silently use the victim's Windows Hello for Business key to authenticate to Microsoft Entra ID. The attacker can then establish longer-term cloud access, register a device it controls, obtain a Primary Refresh Token (PRT), and add further authentication methods where tenant policies permit. On TPM-backed systems, the attacker does not extract the private key, recover the PIN, or trigger a biometric prompt. Windows ticketing keeps private-key operations available while the user is interactively signed in, allowing code running as the user to ask Windows to sign authentication data. Mollema describes the behavior as a consequence of how Windows Hello for Business works and says it was left as-is. The disclosure does not report active exploitation or victims.
Technical Details
The disclosure does not identify the exact Windows builds or Windows Hello for Business deployment models tested. The Hacker News found no CVE or Microsoft advisory tied to the technique in searches of Microsoft's Security Update Guide , NVD , and CVE.org as of August 6, 2026. Mollema said the ability to invoke Windows Hello for Business keys from a compromised session was presented at DEF CON 32 in 2024 . That method could produce a signed assertion for a PRT, but also required access to an Entra-registered or joined device. The new work removes that requirement by treating the Windows Hello for Business key as a FIDO2 passkey through WebAuthn. Mollema found that the five-minute Entra ID challenge is not bound to a session, user, or tenant. An attacker can therefore request it on another host and have the compromised endpoint produce the signed assertion. ROADtools, a framework for interacting with Entra ID, can use the assertion to request tokens or open a browser session as the victim. A token without that device binding lets the attacker register a new device, request a PRT for it, and reach Microsoft cloud services.
Security Impact
Organizations using the affected technology should treat the report according to its high severity classification. Microsoft documents that a PRT remains valid for 90 days and is continuously renewed while the user actively uses the device. Mollema found that the WebAuthn sign-in can satisfy Conditional Access policies requiring Microsoft's phishing-resistant authentication strength . He said the sign-in also counts as fresh multi-factor authentication, allowing an attacker to add passkeys or Windows Hello for Business keys on the new device where policies allow. Separate device-state or compliance policies can still interrupt the chain, so the complete persistence route will not work in every deployment. The finding exposes a limit of phishing-resistant authentication: the credential can remain hardware-bound and unexported while malware inside the signed-in endpoint session invokes it for the attacker. The Hacker News found fido_assertion.ps1 and hellopoc.ps1 in the folder on August 6, 2026. For detection, he recommended hunting for Windows Hello for Business sign-ins with an empty device ID.
Recommended Actions
- Identify whether the affected product, service or software is present in the environment.
- Review the original vendor or research advisory and verify affected versions before making configuration changes.
- Apply vendor-provided security updates or mitigations as soon as operationally practical.
- Review relevant security logs and monitoring alerts for signs of suspicious activity associated with the reported issue.
- Use the CVE identifiers, where available, to validate exposure through vulnerability-management and asset-inventory tools.
Security Details
- Severity: High
- Original source: The Hacker News
Why This Matters
Cybersecurity teams should use reports like this as an input to risk-based vulnerability and threat management rather than relying on headline severity alone. Exposure depends on whether the affected technology is deployed, reachable by an attacker and protected by compensating controls. Confirming asset ownership, affected versions and available vendor fixes helps teams prioritize remediation while avoiding unnecessary emergency changes.
Original Report
NetworkFix recommends reviewing the complete original report from The Hacker News for the authoritative technical context, affected versions, indicators and vendor-specific remediation details: Read the original report.
