Summary Points
- Malware in a signed-in Windows session can silently hijack Windows Hello for Business keys to authenticate to Azure AD, enabling persistent cloud access without user interaction or administrator privileges.
- Attackers can exploit a flaw to use Windows Hello keys as FIDO2 passkeys via WebAuthn, allowing them to request tokens, register new devices, and bypass device-specific security policies.
- The vulnerability enables attackers to maintain long-term access through compromised sessions, even without extracting private keys, by leveraging sign-ins that appear legitimate but lack device binding information.
Threat, Attack Techniques, and Targets
Malware can secretly use Windows Hello for Business keys to access Microsoft Entra ID. This technique requires that the malware already be running in a signed-in Windows session. The attacker does not need admin rights. They can establish long-term cloud access and register devices they control. The malware can obtain a Primary Refresh Token (PRT) and add more authentication methods if policies allow.
On systems with a Trusted Platform Module (TPM), the attacker does not need to extract the private key or PIN. Windows ticketing keeps private operations available during an active session. The malware can ask Windows to sign authentication data, making this technique effective without user interaction. The behavior was shown at DEF CON 32 in 2024. To date, no active exploitation or victims have been reported. Monitoring unexpected device registrations is recommended.
This attack mainly targets organizations using Entra ID with Windows Hello for Business. It relies on code execution within a logged-in Windows session. The method exploits how Windows Hello manages keys and authentication processes.
Impact, Security Implications, and Remediation Guidance
The technique can allow an attacker to stay connected to cloud services for an extended time. It can enable device registration, token requests, and persistence in the victim’s environment. The attacker can bypass some security policies, especially if device and app policies do not detect the malicious activity. It also demonstrates a limitation of phishing-resistant authentication, as malware inside a session can invoke hardware-bound credentials without exporting them.
Since there are no specific CVEs or Microsoft advisories linked to this method, organizations should proceed with caution. Microsoft’s documentation explains the ticketing behavior, but specific remediation steps are not provided in the report. Organizations should consult their security vendors or Microsoft for guidance. Monitoring for unusual device registration or sign-in patterns is essential. Detection strategies include hunting for sign-ins with empty device IDs, which may indicate malicious activity.
Continue Your Tech Journey
Stay informed on the revolutionary breakthroughs in Quantum Computing research.
Access comprehensive resources on technology by visiting Wikipedia.
ThreatIntel-V1
