Malware Exploits Windows Hello for Business Keys to Gain Persistent Entra ID Access

"monitoring unexpected device registrations," recommends Entra ID researcher Dirk‑jan Mollema.

Dirk‑jan Mollema’s demonstration

Mollema demonstrated that malware already running inside a signed‑in Windows session can silently use the victim’s Windows Hello for Business (WHfB) key to authenticate to Microsoft Entra ID. The disclosure describes a chain that begins with code execution in an interactive user session and can end with longer‑term cloud access: an attacker can register a device they control, obtain a Primary Refresh Token (PRT), and add further authentication methods where tenant policies permit. Mollema describes the behavior as a consequence of how Windows Hello for Business works and says it was left as‑is. The disclosure does not report active exploitation or identified victims.

How Windows Hello for Business keys are abused

On TPM‑backed systems, Mollema found the attacker does not extract the private key, recover the PIN, or trigger a biometric prompt. Instead, Windows ticketing keeps private‑key operations available while the user is interactively signed in, allowing code running as that user to ask Windows to sign authentication data. Administrator privileges are not required. The finding exposes a limit of phishing‑resistant authentication: the credential can remain hardware‑bound and unexported while malware inside the signed‑in endpoint session invokes it for an attacker.

Entra ID, WebAuthn and the five‑minute challenge

Earlier presentations at DEF CON 32 in 2024 showed a method that could produce a signed assertion for a PRT but required access to an Entra‑registered or joined device. The new work removes that requirement by treating the WHfB key as a FIDO2 passkey through WebAuthn. Mollema found that the five‑minute Entra ID challenge is not bound to a session, user, or tenant: an attacker can request the challenge on another host and have the compromised endpoint produce the signed assertion. A signed assertion obtained this way can be used to request tokens or open a browser session as the victim.

Mollema reported that the token returned after this flow carries no device ID claim. A token without device binding allows an attacker to register a new device, request a PRT for it, and reach Microsoft cloud services. Microsoft documents that a PRT remains valid for 90 days and is continuously renewed while the user actively uses the device. Mollema also found the WebAuthn sign‑in can satisfy Conditional Access policies that require Microsoft’s phishing‑resistant authentication strength and that the sign‑in counts as fresh multi‑factor authentication—enabling an attacker, where policies allow, to add passkeys or WHfB keys on the new device.

That said, Mollema notes separate device‑state or compliance policies can interrupt the chain; the complete persistence route will not work in every deployment.

ROADtools proof‑of‑concept and detection guidance

Mollema published PowerShell proof‑of‑concept scripts in the ROADtools repository. The Hacker News found fido_assertion.ps1 and hellopoc.ps1 in that folder on August 6, 2026. ROADtools, a framework for interacting with Entra ID, can use a produced assertion to request tokens or open a browser session as the victim.

For detection, Mollema recommended hunting for Windows Hello for Business sign‑ins with an empty device ID. The disclosure notes that legitimate incognito or non‑SSO browser sessions can produce the same pattern, so such detections will require contextual analysis.

What this means for security teams, enterprises, and end users

• Security teams and technologists: Review logs for WHfB sign‑ins that lack a device ID and consider workflows for investigating unexpected device registrations, as Mollema recommends. Expect that ticketing behavior on interactive Windows sessions can be invoked without exporting private keys.
• Enterprise IT and compliance owners: Understand that Conditional Access configurations and device‑state/compliance policies can interrupt the persistence chain; where those policies are enforced they may reduce exposure, but they do not eliminate the underlying capability described by Mollema.
• End users: The technique requires code execution inside an already signed‑in session; maintaining endpoint hygiene and preventing user‑session compromise remain primary controls to prevent this class of misuse.

The Hacker News searched Microsoft’s Security Update Guide, the NVD, and CVE.org and found no CVE or Microsoft advisory tied to the technique as of August 6, 2026. The Hacker News has contacted Microsoft and Mollema; replies are pending. The technical chain Mollema outlines — Windows ticketing availability during interactive sign‑in, a five‑minute Entra challenge that is not session‑bound, and token responses without device binding — shows how a hardware‑bound key can be invoked remotely from a compromised session to obtain long‑lived cloud access. That confluence of behaviors, and the published proof‑of‑concept scripts, gives defenders a specific hunting pattern and gives administrators a narrow set of policy levers that can break the chain.

Original reporting: https://thehackernews.com/2026/08/malware-can-abuse-windows-hello-for.html