Entra ID researcher Dirk-jan Mollema has uncovered a technique that allows malware already running on a compromised Windows machine to silently use a victim's Windows Hello for Business key. The attacker can authenticate to Microsoft Entra ID without ever extracting the private key, recovering the PIN, or triggering any biometric prompt.
Once the authentication succeeds, the attacker can establish persistent cloud access. They may be able to register their device, get a Primary Refresh Token, and add more authentication methods as well wherever tenant policies allow it. This poses a major threat to organizations that depend upon Windows Hello for Business for phishing-resistant authentication.
Let me walk through how this Windows Hello for Business key abuse technique works, what it enables, and how you can defend against it.
How the Windows Hello for Business Key Abuse Works
The technique requires one condition: code execution in the victim's signed-in session. Once malware is running, it can invoke the Windows Hello key through native Windows cryptographic interfaces. Windows ticketing keeps private-key operations available while the user is interactively signed in, so the malware can simply ask Windows to sign authentication data on behalf of the user.
Administrator privileges are not required. The malware operates with the same privileges as the signed-in user, making this a low-privilege attack.
Mollema previously demonstrated a similar technique at DEF CON 32 in 2024.
That earlier method could produce a signed assertion for a PRT but required access to an Entra-registered or joined device. His new research removes that requirement entirely. The Windows Hello for Business key is treated as a FIDO2 passkey through WebAuthn, opening up a much broader attack surface.
The Attack Chain Step by Step
The attack chain begins with the malware requesting an Entra ID challenge.
Mollema discovered that the five-minute challenge is not bound to a session, user, or tenant. This means the attacker can request the challenge on a different host and have the compromised endpoint produce the signed assertion.
Once the signed assertion is obtained, the attacker uses ROADtools, a framework for interacting with Entra ID, to request tokens or open a browser session as the victim. The token carries no device ID claim, which is the key to the Windows Hello for Business key abuse technique.
Without a device ID binding, the attacker can register a new device, request a Primary Refresh Token for it, and access Microsoft cloud services. Microsoft documents that a PRT remains valid for 90 days and is continuously renewed while the user actively uses the device. This gives the attacker a remarkably persistent foothold.
The Role of Conditional Access Policies
The Windows Hello for Business key abuse technique raises important questions about Conditional Access policies. Mollema found that the WebAuthn sign-in can satisfy Conditional Access policies requiring Microsoft's phishing-resistant authentication strength. The sign-in also counts as fresh multi-factor authentication.
If tenant policies permit, the attacker can add passkeys or Windows Hello for Business keys on the new device they control. This effectively gives them the same authentication capabilities as the legitimate user.
However, separate device-state or compliance policies can still interrupt the chain. The complete persistence route will not work in every deployment. Organizations with strong device compliance policies may still block the attack.
What the Technique Exposes About Phishing-Resistant Authentication
The Windows Hello for Business key abuse technique exposes a fundamental limit of phishing-resistant authentication. The credential remains hardware-bound and unexportable, but malware running inside the signed-in session can still invoke it for the attacker.
This is a subtle but important distinction. Phishing-resistant authentication prevents credential theft through social engineering or man-in-the-middle attacks. It does not prevent credential abuse when the endpoint itself is compromised. Once an attacker has code execution on a signed-in system, they can use whatever authentication capabilities that session offers.
Public Proof of Concept Available
Mollema has published PowerShell proof-of-concept scripts in the ROADtools repository. The Hacker News found fido_assertion.ps1 and hellopoc.ps1 available as of August 6, 2026. These scripts show how the Windows Hello for Business key abuse can be done and allows reproducing it.
The release of the PoC raises the risk of its exploitation in practice. Any attacker who can gain code execution on a Windows system with Windows Hello for Business can now use these scripts to pivot to Entra ID.
Detection Guidance
Mollema has provided specific guidance for detecting the Windows Hello for Business key abuse technique. Security teams should hunt for Windows Hello for Business sign-ins with an empty device ID. These sign-ins indicate that an assertion was made without a corresponding device binding.
However, legitimate incognito or non-SSO browser sessions can produce the same pattern. It implies that detection needs to be done through careful contextual analysis. Administrators must also keep track of unexpected device registrations.
No CVE or Patch Coming
The disclosure does not identify the exact Windows builds or Windows Hello for Business deployment models tested. The Hacker News found no CVE or Microsoft advisory tied to the Windows Hello for Business key abuse technique in searches of Microsoft's Security Update Guide, NVD, and CVE.org as of August 6, 2026.
Mollema describes the behavior as a consequence of how Windows Hello for Business works and says it was left as-is. This suggests that Microsoft does not consider this a vulnerability requiring a patch. It is an inherent design characteristic of the system.
The Hacker News has contacted Microsoft and Mollema for comment. Replies are pending.
The Broader Context of Passkey Security
The Windows Hello for Business key abuse technique is part of a broader conversation about passkey security. Researchers have recently uncovered other issues in Windows 11 and Microsoft Entra ID related to passkey implementations.
One researcher found that Windows 11 was writing a complete copy of the digital key to the event log. Reusing of assertions was not properly prevented in Entra ID either. These vulnerabilities were discovered and reported to Microsoft, which fixed them in July 2026.
The research shows that passkeys are still a major improvement over passwords, but they are not magic. If surrounding implementation is flawed, attackers can still reintroduce replay, relay, and phishing-like attack paths even when the underlying WebAuthn cryptography is sound.
What Defenders Should Do
The Windows Hello for Business key abuse technique requires a multi-layered defense approach. Organizations cannot rely solely on phishing-resistant authentication.
- First, apply policies on device compliance. Policies on device state/compliance will break the attack chain and will prevent full persistence from being achieved.
- Second, look for abnormal device registration activities. Registration of the device is mandatory to achieve persistence. It is an observable action.
- Third, hunt for Windows Hello for Business sign-ins with empty device IDs. Whereas this can occur in valid sessions as well, it should be looked into.
- Fourth, focus on patching the Windows 11 and Entra ID passkey vulnerabilities. This is because these have been fixed in July 2026.
- Lastly, consider that if an endpoint allows code execution, it is already compromised. This is because the exploit of the Windows Hello for Business key works within the signed session only.
Wrapping It Up
The Windows Hello for Business key abuse technique is a significant identity security finding. It enables the authentication of malware operating within an authenticated Windows account session to Entra ID without key extraction and biometric prompts.
The attacker is able to create persistent cloud access by acquiring the Primary Refresh Token, registering a device, and adding authentications methods. The exploit can be performed without elevated permissions.
No CVE or Microsoft advisory is attached to the Windows Hello for Business key abuse technique. It appears to be an inherent design characteristic. Defenders must look out for any signs of abuse and ensure compliance with their device policies.
Windows Hello for Business Key Abuse is an example showing that phishing resistant authentication is not a panacea. The endpoint compromise still poses a danger to the identity infrastructure of an organization.
FAQ Section
What is the Windows Hello for Business key abuse technique?
It is a method where malware already running in a signed-in Windows session can silently use the victim's Windows Hello for Business key to authenticate to Microsoft Entra ID without extracting the private key or triggering a biometric prompt.
Do I need administrator privileges to perform this attack?
No. The technique works with the privileges of the signed-in user and does not require administrator privileges.
Can the attacker extract the private key?
No. The attacker does not extract the private key. They simply ask Windows to sign authentication data on their behalf while the user is signed in.
How can I detect this activity?
Monitor for Windows Hello for Business sign-ins with an empty device ID. Also monitor for unexpected device registrations.
Has this been exploited in the wild?
The disclosure does not report active exploitation. However, public proof-of-concept scripts are available in the ROADtools repository.
