Malware Can Abuse Windows Hello for Business Keys for Persistent Entra ID Access
Summary: Entra ID researcher Dirk-jan Mollema demonstrated that malware running in a signed-in Windows session can use the victim's Windows Hello for Business key to authenticate to Microsoft Entra ID, register a device it controls, obtain a Primary Refresh Token, and add further authentication methods where tenant policies permit. On TPM-backed systems the attacker does not extract the private key, recover the PIN, or trigger a biometric prompt, and administrator privileges are not required; Mollema published PowerShell proof-of-concept scripts in the ROADtools repository, and The Hacker News found no CVE or Microsoft advisory tied to the technique as of August 6, 2026.
What's compelling: A Primary Refresh Token stays valid for 90 days and renews continuously while the user works, so a single compromised session can yield months of cloud access - and Mollema found the WebAuthn sign-in still satisfies Conditional Access policies requiring phishing-resistant authentication strength and counts as fresh multi-factor authentication.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026