Malware Abuses Windows Hello for Business Keys for Persistent Entra ID Access
A new attack technique allows malware to leverage Windows Hello for Business keys for persistent access to Microsoft Entra ID without user interaction or administrator privileges.
Security researcher Dirk-jan Mollema has demonstrated a novel attack vector that enables malware, already present within a signed-in Windows session, to silently utilize a victim's Windows Hello for Business (WHfB) key for authentication to Microsoft Entra ID. This technique bypasses the need for the attacker to extract private keys, recover PINs, or trigger biometric prompts on TPM-backed systems, offering a sophisticated method for establishing long-term cloud access.
The core of the exploit lies in how Windows handles private-key operations while a user is interactively signed in. Code executing within the user's session can request Windows to sign authentication data using the WHfB key. Crucially, this process does not require administrator privileges and exploits the built-in ticketing behavior of Windows. While the ability to invoke WHfB keys from a compromised session was previously demonstrated at DEF CON 32 in 2024, requiring access to an Entra-registered or joined device, this new method removes that dependency.
Mollema's latest findings reveal that the WHfB key can be treated as a FIDO2 passkey via WebAuthn. The five-minute Entra ID challenge, which is not bound to a specific session, user, or tenant, can be requested on an attacker-controlled host. The compromised endpoint can then produce the signed assertion, which is then used by tools like ROADtools to obtain tokens or initiate browser sessions as the victim.
Once authenticated, the attacker can register a device they control with Entra ID and obtain a Primary Refresh Token (PRT). This PRT, valid for up to 90 days and continuously renewed with active use, allows access to Microsoft cloud services. A significant aspect of this attack is that the generated token lacks a device ID claim, enabling the attacker to effectively impersonate the victim on a new, unregistered device.
Furthermore, the WebAuthn sign-in can satisfy Conditional Access policies that mandate phishing-resistant authentication strength. It also counts as fresh multi-factor authentication, empowering attackers to add their own credentials, such as passkeys or additional WHfB keys, to the newly registered device if tenant policies permit. However, the complete persistence chain may be interrupted by separate device-state or compliance policies, meaning the attack is not universally effective across all deployments.
This discovery highlights a critical limitation in phishing-resistant authentication: while the credential itself remains hardware-bound and unexportable, malware operating within a compromised endpoint session can still invoke it on behalf of an attacker. This effectively circumvents the intended security benefits of hardware-backed keys when the endpoint itself is compromised.
Mollema has published PowerShell proof-of-concept scripts, including fido_assertion.ps1 and hellopoc.ps1, within the ROADtools repository to demonstrate the technique. For detection, Mollema recommends actively hunting for Windows Hello for Business sign-ins that present an empty device ID, though he notes that legitimate incognito or non-SSO browser sessions can also produce this pattern, requiring careful analysis.
As of August 6, 2026, there are no publicly disclosed CVEs or Microsoft advisories directly tied to this specific technique. The disclosure does not mention active exploitation or specific victims, and Microsoft's response is pending. Organizations are advised to monitor for unexpected device registrations and review their Conditional Access and device compliance policies to mitigate potential risks.