Malware Can Hijack Windows Hello for Business Keys to Backdoor Your Microsoft Cloud Account

Security researcher Dirk-jan Mollema has demonstrated that malware running inside an active Windows session can silently abuse Windows Hello for Business keys to authenticate to Microsoft Entra ID, no admin rights required, no PIN prompt, no biometric interaction.

Once in, an attacker can register their own device, grab a Primary Refresh Token (PRT), and bolt on additional authentication methods depending on how permissive the tenant's policies are. The result is durable cloud access that persists well beyond the original compromise.

The clever part is what doesn't happen. On TPM-backed systems, the private key never leaves the hardware. The attacker doesn't extract it, crack it, or bypass biometrics. They simply ask Windows to sign authentication data on their behalf, which Windows will happily do for any code running as the signed-in user. That's not a bug Microsoft overlooked accidentally. Mollema describes it as a consequence of how the system was designed, and apparently it's staying that way.

The attack builds on earlier work Mollema presented at DEF CON 32 in 2024, which showed how to invoke Windows Hello for Business keys from a compromised session to produce a signed PRT assertion. That technique had a catch though: it needed access to an Entra-registered or joined device. The new approach drops that requirement entirely.

The trick is treating the Windows Hello for Business key as a FIDO2 passkey via WebAuthn. Mollema discovered that the five-minute Entra ID authentication challenge isn't bound to a specific session, user, or tenant. So an attacker can generate the challenge on a separate machine, relay it to the victim's endpoint, and have that endpoint sign the assertion. Mollema's ROADtools framework can then use the resulting assertion to request tokens or open a browser session as the victim.

The token produced this way carries no device ID claim. That gap is significant. Without device binding, the attacker can register a fresh device of their own, request a PRT for it, and from there reach Microsoft cloud services. PRTs stay valid for 90 days and keep renewing as long as the user's device remains active.

Worse, Mollema found the WebAuthn sign-in satisfies Conditional Access policies enforcing Microsoft's phishing-resistant authentication strength. It also qualifies as fresh multi-factor authentication, which in permissive environments lets an attacker register additional passkeys or Windows Hello for Business keys on their newly registered device. Stricter device compliance or state policies can break the chain, so this won't work universally. But it will work in plenty of real-world deployments.

The finding puts a dent in the comfort many organisations take from phishing-resistant credentials. Hardware-bound, unexportable keys sound airtight until you remember that malware inside the session doesn't need to export anything. It just asks nicely.

Proof-of-concept PowerShell scripts, fido_assertion.ps1 and hellopoc.ps1, are sitting in the ROADtools repository if you want to see exactly how this works.

No CVE has been assigned. As of early August 2026, The Hacker News found nothing in Microsoft's Security Update Guide, NVD, or CVE.org. Microsoft hasn't publicly responded. There's no evidence of active exploitation.

For detection, Mollema suggests hunting for Windows Hello for Business sign-ins with an empty device ID field. Fair warning: legitimate incognito browser sessions and non-SSO flows can produce the same pattern, so expect some noise. Monitoring for unexpected device registrations is the cleaner signal.