Malware can drive a Windows Hello key for Entra ID persistence without a PIN prompt
Dirk-jan Mollema showed that code running in a signed-in Windows session can use the victim's TPM-bound Windows Hello for Business key as a FIDO2 credential, satisfying phishing-resistant Conditional Access and acquiring a Primary Refresh Token. No admin rights, no CVE.
Entra ID researcher Dirk-jan Mollema demonstrated that malware already running inside a signed-in Windows session can silently use the victim's Windows Hello for Business key to authenticate to Microsoft Entra ID. The attacker never extracts the private key, recovers the PIN, or triggers a biometric prompt: Windows keeps private-key operations available to code running as the user while they are interactively signed in, so a TPM offers no protection here and administrator rights are not required. Mollema found the five-minute Entra WebAuthn challenge is not bound to session, user, or tenant, so it can be requested on one host and signed on another.
Why it matters
This turns a phishing-resistant credential into a persistence mechanism. The resulting FIDO2 assertion satisfies Conditional Access policies that demand phishing-resistant authentication, and because the token may lack a device ID claim, it can be used to register an attacker-controlled device and obtain a Primary Refresh Token valid for 90 days and continuously renewed. From there the attacker can add further authentication methods where tenant policy allows, surviving a password reset. Microsoft had issued no CVE or advisory at publication. Detection: hunt Windows Hello for Business sign-ins with an empty device ID, accepting that legitimate incognito sessions look the same. Device compliance policies can interrupt the persistence chain. Mollema published proofs of concept in ROADtools. Related: our roundup of three passkey attacks.
Source: The Hacker News
Related on Start with Identity
- BlogUnit 42 finds malware can extract Google's synced passkey keys straight out of Chrome's memory
Palo Alto Networks Unit 42 disclosed three attacks, Pass-ta-key, Silver Pass-ta-key, and Golden Pass-ta-key, that extract device identity keys and the master se
- BlogPass-the-Passkey: a Black Hat researcher found the WebAuthn implementation bugs, not the standard
At Black Hat USA 2026, DSInternals researcher Michael Grafnetter presented a family of passkey attacks including cleartext YubiKey signatures readable by any au
- BlogGoogle Workspace puts FIDO2 keys into the Windows login, days after Entra makes passkeys default
Google began rolling out FIDO2 security keys as a second factor at Windows sign-in for all Workspace customers on 13 July. Microsoft is making passkeys the defa
- GlossaryAPI Key
A static secret string used to authenticate an application or caller to an API. Simple but weak: it does not expire on its own, is easy to leak, and should be v
- GuideAPI Key Rotation Automation Guide
A practical guide to automating API key rotation with zero downtime, covering rotation strategies, secrets management integration, dual-key patterns, monitoring
- VendorAzure Key Vault
strong_contender