Windows Hello for Business security vulnerabilities

Security concerns regarding Windows Hello for Business have emerged through technical reports and researcher demonstrations. Initially, the German Federal Office for Information Security (BSI) identified vulnerabilities where attackers with local administrator rights could decrypt and manipulate biometric templates, such as facial or fingerprint data, to impersonate users. The BSI recommended mitigation strategies including the use of Enhanced Sign-in Security (ESS) mode and Trusted Platform Modules (TPM).

Subsequent research expanded on these risks, demonstrating that malware can hijack authentication keys within an active user session to gain persistent access to Microsoft Entra ID environments. This method allows malicious software to exploit native Windows cryptographic interfaces to sign authentication data without needing a PIN or biometric verification. By bypassing TPM hardware protections through the use of an active session, attackers can obtain a Primary Refresh Token (PRT), enabling them to register new devices and maintain long-term, stealthy access to corporate cloud services.