Malware Can Abuse Windows Hello for Business Keys for Persistent Entra ID Access
A researcher demonstrated that malware can use a Windows Hello for Business key to authenticate to Microsoft Entra ID, allowing an attacker to establish longer-term cloud access.
Intelligence analysis by Llama
Malware can use a Windows Hello for Business key to authenticate to Microsoft Entra ID, allowing an attacker to establish longer-term cloud access. This can happen even if the user is interactively signed in, and administrator privileges are not required.
Imagine you have a special key that only you know, and it's used to unlock your computer. But what if someone else could use that key to unlock your computer without you even knowing? That's what happened in this case, where malware used a special key to get into a person's computer without them knowing.
Analysis
Windows Hello for Business and Entra ID Vulnerability
A researcher demonstrated that malware can use a Windows Hello for Business key to authenticate to Microsoft Entra ID. This allows an attacker to establish longer-term cloud access, register a device it controls, obtain a Primary Refresh Token (PRT), and add further authentication methods where tenant policies permit.
The attacker does not extract the private key, recover the PIN, or trigger a biometric prompt. Windows ticketing keeps private-key operations available while the user is interactively signed in, allowing code running as the user to ask Windows to sign authentication data. Administrator privileges are not required.
The technique requires code execution in the victim's signed-in session. The researcher describes the behavior as a consequence of how Windows Hello for Business works and says it was left as-is.
Implications of the Vulnerability
The disclosure does not report active exploitation or victims. However, the researcher recommends monitoring unexpected device registrations. The disclosure does not identify the exact Windows builds or Windows Hello for Business deployment models tested.
Detection and Mitigation
The researcher recommends hunting for Windows Hello for Business sign-ins with an empty device ID. Legitimate incognito or non-SSO browser sessions can produce the same pattern.
Conclusion
The finding exposes a limit of phishing-resistant authentication, as the credential can remain hardware-bound and unexported while malware inside the signed-in endpoint session invokes it for the attacker.
Key points
- Malware can use a Windows Hello for Business key to authenticate to Microsoft Entra ID.
- This allows an attacker to establish longer-term cloud access, register a device it controls, obtain a Primary Refresh Token (PRT), and add further authentication methods where tenant policies permit.
- The attacker does not extract the private key, recover the PIN, or trigger a biometric prompt.
- Windows ticketing keeps private-key operations available while the user is interactively signed in, allowing code running as the user to ask Windows to sign authentication data.
- Administrator privileges are not required for the technique to work.
Microsoft may release a patch to fix this vulnerability, which would prevent malware from using the Windows Hello for Business key to authenticate to Entra ID. This would improve the security of Windows Hello for Business and Entra ID.
If this vulnerability is not patched, it could allow attackers to gain persistent access to Entra ID, which could lead to further security issues and potential data breaches.
