Security researcher has disclosed a technique involving Windows Hello for Business (WHFB) that could allow attackers with access to an active Windows user session to authenticate to Microsoft Entra ID services without needing the victim’s PIN, biometric verification, or password.
Mollema’s research demonstrates how attackers can effectively “borrow” the cryptographic key that underlies Windows Hello authentication from a compromised session. They can then use this key to obtain cloud tokens, register devices they control, and maintain persistence within an Entra ID tenant.
Windows Hello Key Abuse
Windows Hello for Business employs device-bound cryptographic keys, typically secured by a Trusted Platform Module (TPM), instead of traditional passwords. This design aims to prevent the export or theft of private keys.
However, Mollema discovered that a low-privilege process running in a logged-in user’s session can invoke the Windows Passport Key Storage Provider using native Cryptography Next Generation (CNG) functions. This allows the process to request signatures from the WHFB-backed key without prompting for a Windows Hello PIN or biometric verification.
This capability seems to depend on cached authentication data, or “tickets,” that Windows maintains after the user unlocks their session. As a result, malware, implants, or any other process with session-level access could potentially use the key while the victim remains logged in.
The original technique entails using the borrowed Windows Hello key to sign a JWT assertion and request a Primary Refresh Token (PRT). PRTs are crucial for Entra ID single sign-on and can remain valid for up to 90 days and be renewed.
In the past, obtaining a usable PRT through this method required the attacker to operate another Entra ID-joined or registered device. This requirement limited the potential for abuse, as attackers needed access to another account or appropriate tokens to register their infrastructure.
Mollema’s new research significantly lowers this barrier by treating a WHFB key as a WebAuthn/FIDO2 passkey. An attacker can use the victim’s key to sign a Microsoft Entra-issued WebAuthn challenge and carry out a phishing-resistant authentication flow from a different system.
Since the WebAuthn challenge is reportedly not tied to a specific session, device, user, or tenant, it can be fetched on an attacker-controlled host and signed using the victim’s active session. The resulting assertion can then be used to obtain Entra tokens or authenticate into web-based services as if they were the victim.
Tokens procured via the WebAuthn method may lack a device ID claim. While this can pose challenges against Conditional Access policies that require a compliant or managed device state, it also presents a pathway to persistence.
Attackers might use the token to register a new, attacker-controlled Entra device. From there, they could request a PRT for the newly registered device and add additional authentication materials, such as passkeys or Windows Hello keys.
Because WHFB authentication counts as fresh multi-factor authentication (MFA), the attacker may satisfy controls that protect the registration of authentication methods. This could transform a temporary compromise of an active workstation session into a lasting foothold in a cloud identity.
Organizations should monitor for Windows Hello for Business authentications without an associated Entra device ID. The following KQL query can help identify potentially anomalous events:
SigninLogs
| where AuthenticationDetails has '"authenticationMethod":"Windows Hello for Business"'
| where DeviceDetail.deviceId == ""While these sign-ins can occur legitimately, such as in private browsing sessions or browsers that do not support integrated SSO, they are likely uncommon enough to warrant investigation, especially when they are followed by device registration, PRT activity, or changes in authentication methods.
Security teams should also keep an eye on unexpected user-driven device registrations, enforce robust endpoint detection for active user sessions, and review Conditional Access policies that regulate device state and authentication-method enrollment.
Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world
