Windows Hello for Business keys vulnerable to malware hijacking

Cybersecurity researchers have demonstrated that malware can silently abuse Windows Hello for Business authentication keys to gain persistent access to Microsoft Entra ID environments. This vulnerability allows malicious software running within an active user session to hijack cryptographic credentials without requiring a PIN or biometric verification.

Research led by Dirk-jan Mollema shows that a low-level process can exploit native Windows cryptographic interfaces to request the Windows Hello for Business key to sign authentication data. Because the malware operates within an authenticated session, it can bypass the hardware protections of the Trusted Platform Module (TPM) that typically prevent the extraction of private keys. Instead of stealing the key itself, the malware uses the active session to perform authentication requests on behalf of the user.

This method enables attackers to obtain a Primary Refresh Token (PRT), allowing them to register new devices under their control and maintain stealthy, long-term access to corporate cloud services. Unlike previous methods that required a device to be already joined to Entra ID, this approach treats the Windows Hello key similarly to a FIDO2 key via the WebAuthn protocol, potentially expanding the scope of the threat to enterprise networks.