Security researcher Dirk-jan Mollema has demonstrated that malware running inside a signed-in Windows session can silently hijack the victim's Windows Hello for Business key to authenticate to Microsoft Entra ID, Microsoft's cloud identity platform. The technique, disclosed in August 2026, allows an attacker to establish persistent cloud access, register a device under their control, obtain a Primary Refresh Token, and add additional authentication methods where tenant policies permit. No active exploitation or victims have been reported.
On systems with TPM-backed security, the attacker doesn't need to extract the private key, recover the PIN, or trigger a biometric prompt. Windows ticketing keeps private-key operations available while the user is interactively signed in, which means code running as the user can ask Windows to sign authentication data. Administrator privileges aren't required—the technique only needs code execution in the victim's signed-in session. Mollema found that the five-minute Entra ID challenge isn't bound to a session, user, or tenant, so an attacker can request it on another host and have the compromised endpoint produce the signed assertion. The token that results carries no device ID claim, which lets the attacker register a new device, request a Primary Refresh Token for it, and reach Microsoft cloud services. Microsoft documents show a Primary Refresh Token remains valid for 90 days and is continuously renewed while the user actively uses the device.
Mollema describes the behavior as a consequence of how Windows Hello for Business works and says it was left as-is. Microsoft documents the ticketing behavior that enables the technique. Mollema said the ability to invoke Windows Hello for Business keys from a compromised session was presented at DEF CON 32 in 2024, but that method also required access to an Entra-registered or joined device. The new work removes that requirement by treating the Windows Hello for Business key as a FIDO2 passkey through WebAuthn. According to the researcher, the WebAuthn sign-in can satisfy Conditional Access policies requiring Microsoft's phishing-resistant authentication strength, and the sign-in also counts as fresh multi-factor authentication, allowing an attacker to add passkeys or Windows Hello for Business keys on the new device where policies allow. The Hacker News found no CVE or Microsoft advisory tied to the technique in searches of Microsoft's Security Update Guide, NVD, and CVE.org as of August 6, 2026.
The finding exposes a fundamental limit of phishing-resistant authentication: the credential can remain hardware-bound and unexported while malware inside the signed-in endpoint session invokes it for the attacker. Because Windows keeps the key material accessible during an active user session, any code running with user-level permissions can request cryptographic signatures without triggering the security checks—biometric scans or PIN entry—that would normally protect the key. The researcher published PowerShell proof-of-concept scripts in the ROADtools repository, a framework for interacting with Entra ID, which can use the assertion to request tokens or open a browser session as the victim. Separate device-state or compliance policies can still interrupt the chain, so the complete persistence route won't work in every deployment. Mollema recommends monitoring unexpected device registrations and hunting for Windows Hello for Business sign-ins with an empty device ID, though legitimate incognito or non-SSO browser sessions can produce the same pattern. Organizations relying on hardware-backed authentication as a final line of defense may need to reconsider endpoint security controls, since the technique shows that compromising the session layer can bypass protections designed to keep credentials out of attackers' hands. The disclosure underscores a trade-off inherent in passwordless systems: improving user experience by keeping keys available during active sessions also creates a window for attackers who've already breached the endpoint.