Malware Abuses Windows Hello for Business Keys for Persistent Entra ID Access
A new attack technique allows malware to leverage Windows Hello for Business keys for persistent access to Microsoft Entra ID without user interaction or administrator privileges.
Security researcher Dirk-jan Mollema has demonstrated a novel attack vector that enables malware, already present within a signed-in Windows session, to silently utilize a victim's Windows Hello for Business (WHfB) key for authentication to Microsoft Entra ID. This technique bypasses the need for the attacker to extract private keys, recover PINs, or trigger biometric prompts on TPM-backed systems, offering a sophisticated method for establishing long-term cloud access.
The core of the exploit lies in how Windows handles private-key operations while a user is interactively signed in. Code executing within the user's session can request Windows to sign authentication data using the WHfB key. Crucially, this process does not require administrator privileges and exploits the built-in ticketing behavior of Windows. While the ability to invoke WHfB keys from a compromised session was previously demonstrated at DEF CON 32 in 2024, requiring access to an Entra-registered or joined device, this new method removes that dependency.
Mollema's latest findings reveal that the WHfB key can be treated as a FIDO2 passkey via WebAuthn. The five-minute Entra ID challenge, which is not bound to a specific session, user, or tenant, can be requested on an attacker-controlled host. The compromised endpoint can then produce the signed assertion, which is then used by tools like ROADtools to obtain tokens or initiate browser sessions as the victim.
Once authenticated, the attacker can register a device they control with Entra ID and obtain a Primary Refresh Token (PRT). This PRT, valid for up to 90 days and continuously renewed with active use, allows access to Microsoft cloud services. A significant aspect of this attack is that the generated token lacks a device ID claim, enabling the attacker to effectively impersonate the victim on a new, unregistered device.
Furthermore, the WebAuthn sign-in can satisfy Conditional Access policies that mandate phishing-resistant authentication strength. It also counts as fresh multi-factor authentication, empowering attackers to add their own credentials, such as passkeys or additional WHfB keys, to the newly registered device if tenant policies permit. However, the complete persistence chain may be interrupted by separate device-state or compliance policies, meaning the attack is not universally effective across all deployments.
This discovery highlights a critical limitation in phishing-resistant authentication: while the credential itself remains hardware-bound and unexportable, malware operating within a compromised endpoint session can still invoke it on behalf of an attacker. This effectively circumvents the intended security benefits of hardware-backed keys when the endpoint itself is compromised.
Mollema has published PowerShell proof-of-concept scripts, including fido_assertion.ps1 and hellopoc.ps1, within the ROADtools repository to demonstrate the technique. For detection, Mollema recommends actively hunting for Windows Hello for Business sign-ins that present an empty device ID, though he notes that legitimate incognito or non-SSO browser sessions can also produce this pattern, requiring careful analysis.
As of August 6, 2026, there are no publicly disclosed CVEs or Microsoft advisories directly tied to this specific technique. The disclosure does not mention active exploitation or specific victims, and Microsoft's response is pending. Organizations are advised to monitor for unexpected device registrations and review their Conditional Access and device compliance policies to mitigate potential risks.
This new research details two specific attack paths: leveraging the WHFB key to obtain Primary Refresh Tokens (PRTs) for long-lived access, or using the key as a FIDO2 passkey via WebAuthn to authenticate from separate machines. The WebAuthn method is particularly concerning as it can result in authentication tokens lacking a device identifier, potentially allowing attackers to register new, attacker-controlled devices in Microsoft Entra ID.
Microsoft is further streamlining multi-factor authentication (MFA) for Windows Hello for Business (WHfB) and macOS Platform Single Sign-On (PSSO) users by removing an extra MFA hurdle for these sign-in methods. This change, rolling out in October 2026, means WHfB and PSSO will satisfy all MFA requirements, including step-up prompts and sign-in frequency checks, without needing an additional registered passkey. While this aims to boost phishing-resistant authentication, users are advised to register a portable MFA method like a synced passkey for situations where device-bound credentials are unavailable.