Malware Exploits Windows Hello for Business for Persistent Entra ID Access

Researchers discovered that malware can leverage Windows Hello for Business keys to maintain persistent access to Microsoft Entra ID without extracting private keys or PINs. This exploit allows attackers to register controlled devices, obtain Primary Refresh Tokens, and bypass certain authentication policies, highlighting a critical vulnerability in phishing-resistant authentication mechanisms.

Entra ID researcher Dirk-jan Mollema demonstrated that malware already running in a signed-in Windows session can silently use the victim's Windows Hello for Business key to authenticate to Microsoft Entra ID.

The attacker can then establish longer-term cloud access, register a device it controls, obtain a Primary Refresh Token (PRT), and add further authentication methods where tenant policies

Read original article