# Windows Hello for Business security vulnerabilities > Live situation record from CLSTR: https://clstr.news/situations/windows-hello-for-business-security-vulnerabilities > Updated: 2026-08-11T03:06:52.000Z. Sources: 2. Developments: 2. Security concerns regarding Windows Hello for Business have emerged through technical reports and researcher demonstrations. Initially, the German Federal Office for Information Security (BSI) identified vulnerabilities where attackers with local administrator rights could decrypt and manipulate biometric templates, such as facial or fingerprint data, to impersonate users. The BSI recommended mitigation strategies including the use of Enhanced Sign-in Security (ESS) mode and Trusted Platform Modules (TPM). Subsequent research expanded on these risks, demonstrating that malware can hijack authentication keys within an active user session to gain persistent access to Microsoft Entra ID environments. This method allows malicious software to exploit native Windows cryptographic interfaces to sign authentication data without needing a PIN or biometric verification. By bypassing TPM hardware protections through the use of an active session, attackers can obtain a Primary Refresh Token (PRT), enabling them to register new devices and maintain long-term, stealthy access to corporate cloud services. ## Timeline ### 2026-08-11: Windows Hello for Business keys vulnerable to malware hijacking Malware can bypass PINs and biometrics by hijacking Windows Hello for Business keys to gain persistent, silent access to Microsoft Entra ID cloud environments. 2 sources. https://clstr.news/cluster/windows-hello-for-business-keys-vulnerable-to-malware-hijacking ### 2026-07-26: German BSI warns Windows Hello for Business vulnerable to admin‑level attacks BSI's new report flags Windows Hello for Business as vulnerable to local admin attacks that can manipulate biometric data, urging ESS, TPM and stricter configuration to protect enterprise logins. 6 sources. https://clstr.news/cluster/german-bsi-warns-windows-hello-for-business-vulnerable-to-adminlevel-attacks --- Cite as: Windows Hello for Business security vulnerabilities. CLSTR, https://clstr.news/situations/windows-hello-for-business-security-vulnerabilities