# Malware can drive a Windows Hello key for Entra ID persistence without a PIN prompt

Source: https://startwithidentity.com/blog/2026-08-07-windows-hello-for-business-keys-abused-for-entra-id-persistence/
Last updated: 2026-08-29
License: content by Start with Identity. Cite the source URL.

---

Entra ID researcher Dirk-jan Mollema demonstrated that malware already running inside a signed-in Windows session can silently use the victim's Windows Hello for Business key to authenticate to Microsoft [Entra ID](https://startwithidentity.com/vendors/iam/microsoft-entra/). The attacker never extracts the private key, recovers the PIN, or triggers a biometric prompt: Windows keeps private-key operations available to code running as the user while they are interactively signed in, so a TPM offers no protection here and administrator rights are not required. Mollema found the five-minute Entra [WebAuthn](https://startwithidentity.com/standards/webauthn-fido2/) challenge is not bound to session, user, or tenant, so it can be requested on one host and signed on another.

## Why it matters

This turns a phishing-resistant credential into a persistence mechanism. The resulting FIDO2 assertion satisfies [Conditional Access](https://startwithidentity.com/glossary/conditional-access/) policies that demand phishing-resistant authentication, and because the token may lack a device ID claim, it can be used to register an attacker-controlled device and obtain a [Primary Refresh Token](https://startwithidentity.com/glossary/refresh-token/) valid for 90 days and continuously renewed. From there the attacker can add further authentication methods where tenant policy allows, surviving a password reset. Microsoft had issued no CVE or advisory at publication. Detection: hunt Windows Hello for Business sign-ins with an empty device ID, accepting that legitimate incognito sessions look the same. Device compliance policies can interrupt the persistence chain. Mollema published proofs of concept in ROADtools. Related: our roundup of [three passkey attacks](https://startwithidentity.com/blog/2026-08-10-three-passkey-attacks-target-everything-except-the-cryptography/).

Source: [The Hacker News](https://thehackernews.com/2026/08/malware-can-abuse-windows-hello-for.html)