Malware Can Abuse Windows Hello for Business Keys for Persistent Entra ID Access

1. Executive summary

Security researcher Dirk-jan Mollema demonstrated that malware running in a signed-in Windows session can silently invoke the victim's Windows Hello for Business (WHfB) key to authenticate to Microsoft Entra ID — without extracting the private key, recovering the PIN, or triggering a biometric prompt. The attacker can register a new device, obtain a Primary Refresh Token (PRT) valid for 90 days, and add additional authentication methods where tenant policies permit. No CVE has been assigned; Microsoft has not classified this as a vulnerability. No active exploitation or victims have been reported. EMEA financial services relying on WHfB as a phishing-resistant MFA factor should assess Conditional Access and device-state controls immediately, as the technique bypasses the assumption that hardware-bound credentials cannot be abused by session-level malware.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. The technique is a design-behaviour disclosure with no confirmed incident, no third-party provider failure, and no CVE classification. General ICT risk management obligations under DORA Art. 17 and NIS2 Art. 21(2)(d) are always present for financial entities, but no fact in this item triggers a distinctive obligation beyond routine security posture — mapping them here would be compliance-checkbox padding.

3. Technical analysis & attack chain

Confirmed attack chain (single-sourced to researcher disclosure via The Hacker News; verify before enforcement)

1. Prerequisite — code execution in signed-in session. The attacker must already have malware running as the signed-in user. Administrator privileges are NOT required. The user must be interactively signed in to Windows.
2. WHfB key invoked as FIDO2 passkey via WebAuthn. The attacker's code treats the WHfB key as a WebAuthn/FIDO2 credential. Windows ticketing keeps private-key operations available while the user is interactively signed in, allowing user-context code to ask Windows to sign authentication data. On TPM-backed systems, the private key never leaves the TPM; the attacker never extracts it, recovers the PIN, or prompts biometrics.
3. Challenge decoupled from session. Mollema found that the five-minute Entra ID WebAuthn challenge is not bound to a session, user, or tenant. An attacker can request the challenge on a separate host and have the compromised endpoint produce the signed assertion.
4. Token obtained via ROADtools. The signed assertion is fed to ROADtools (a framework for interacting with Entra ID) to request tokens or open a browser session as the victim. Proof-of-concept scripts fido_assertion.ps1 and hellopoc.ps1 were published in the ROADtools repository.
5. Token carries no device ID claim. The resulting token has no device ID binding. This lets the attacker register a new device they control and request a PRT for it.
6. PRT persistence. A PRT remains valid for 90 days and is continuously renewed while the attacker actively uses the registered device. This establishes long-term cloud persistence.
7. MFA and Conditional Access bypass. The WebAuthn sign-in satisfies Conditional Access policies requiring Microsoft's phishing-resistant authentication strength. It also counts as fresh MFA, allowing the attacker to add passkeys or WHfB keys on the new device where tenant policies allow.
8. Limitations. Separate device-state or compliance policies can still interrupt the chain. The complete persistence route will not work in every deployment.

Key technical details

• No CVE assigned. The Hacker News searched Microsoft's Security Update Guide, NVD, and CVE.org as of August 6, 2026 — no advisory was found. Microsoft has been contacted; replies pending.
• Not classified as vulnerability by Microsoft. Mollema describes the behaviour as a consequence of how WHfB works and says it was left as-is.
• Prior work. A related method was presented at DEF CON 32 (2024) that could produce a signed assertion for a PRT but required access to an Entra-registered or joined device. The new work removes that requirement by using the WHfB key through WebAuthn.
• Exact Windows builds and WHfB deployment models tested are not identified in the disclosure.

Confidence caveat: This advisory is based on a single researcher disclosure reported by The Hacker News. No independent corroboration of the technique's feasibility has been published. No IOCs, no observed exploitation, and no victim data exist. Verify the technique against your own Entra tenant before enforcement.

4. Mitigation & containment

P1 — Within 24 hours

• Hunt for WHfB sign-ins with empty device ID. Query Entra ID sign-in logs for authentication events where deviceDetail.deviceId is null or empty and the authentication method is Windows Hello for Business. Note: legitimate incognito or non-SSO browser sessions can produce the same pattern — triage accordingly.
• Review recent device registrations. Check Entra ID for devices registered in the last 30 days that do not match expected endpoint management enrolment patterns (e.g., not Intune-managed, no compliance attestation).

P2 — Within 72 hours

• Enforce device-state Conditional Access policies. Ensure that Conditional Access policies require device compliance or hybrid Entra join — not just phishing-resistant authentication strength. The technique bypasses the phishing-resistant MFA requirement but is interrupted by device compliance/state checks.
• Restrict additional authentication method registration. Review and tighten Entra ID policies governing who can add passkeys or WHfB keys to a device. Where possible, require admin approval or restrict to managed devices only.
• Audit PRT issuance. Investigate whether your tenant permits PRT issuance for newly registered devices without a managed-device state. If it does, this is the highest-risk configuration for this technique.

P3 — Within 7 days

• Monitor ROADtools and PoC script usage. Deploy EDR detection for fido_assertion.ps1 and hellopoc.ps1 (see §6). Alert on PowerShell invoking WebAuthn/Entra ID token requests from user context without a browser process.
• Review session-level malware detection. Since the technique requires only user-context code execution, ensure endpoint detection covers user-context PowerShell, token-signing operations, and unexpected WebAuthn API calls.
• Track Microsoft response. No patch or configuration change from Microsoft is available as of the disclosure date. Monitor Microsoft's Security Update Guide and Entra ID documentation for updates.

5. Indicators of compromise

No atomic indicators of compromise are available in the source material. No hashes, domains, IPs, or file paths beyond the PoC script names are provided. No active exploitation has been reported.

Behavioural indicators

6. Detection

rule Windows_Hello_Business_Entra_Abuse_PoC_Scripts {
    meta:
        author = "Adverse Trace"
        date = "2026-08-07"
        reference = "https://thehackernews.com/2026/08/malware-can-abuse-windows-hello-for.html"
        description = "Detects PoC PowerShell scripts for WHfB key abuse via WebAuthn for Entra ID access"
    strings:
        $script1 = "fido_assertion.ps1" nocase
        $script2 = "hellopoc.ps1" nocase
        $roadtools = "ROADtools" nocase
    condition:
        2 of them
}

title: Entra ID Sign-in with Windows Hello for Business and Empty Device ID
id: 7a3c1f2e-8b4d-4a6e-9c5f-1d2e3f4a5b6c
status: experimental
description: >
  Detects Windows Hello for Business authentication events in Entra ID sign-in logs
  where the device ID is null or empty. This pattern may indicate abuse of WHfB keys
  via WebAuthn as described in the NatJack/WHfB disclosure. Legitimate incognito or
  non-SSO browser sessions can also produce this pattern.
author: Adverse Trace
date: 2026/08/07
references:

    - https://thehackernews.com/2026/08/malware-can-abuse-windows-hello-for.html
logsource:
    product: azure
    service: signinlogs
detection:
    selection:
        AuthenticationRequirement: "multiFactor"
        AuthenticationDetails|contains: "Windows Hello for Business"
        DeviceDetail.deviceId: null
    filter_legitimate:
        ClientAppUsed|contains:

            - "Browser"
            - "Mobile Apps and Desktop Clients"
    condition: selection and not filter_legitimate
falsepositives:

    - Legitimate incognito or non-SSO browser sessions
    - Non-browser authentication flows that do not carry device claims
level: medium

title: Suspicious PowerShell Scripts for WHfB WebAuthn Abuse
id: 8b4d2e3f-9c5a-4b7f-0d6e-2e3f4a5b6c7d
status: experimental
description: >
  Detects execution of known PoC PowerShell scripts that abuse Windows Hello for
  Business keys through WebAuthn to obtain Entra ID tokens.
author: Adverse Trace
date: 2026/08/07
references:

    - https://thehackernews.com/2026/08/malware-can-abuse-windows-hello-for.html
logsource:
    product: windows
    category: process_creation
detection:
    selection_script:
        CommandLine|contains:

            - "fido_assertion.ps1"
            - "hellopoc.ps1"
    selection_roadtools:
        CommandLine|contains:

            - "ROADtools"
            - "roadtoken"
    condition: selection_script or selection_roadtools
falsepositives:

    - Legitimate red team or security assessment activity
level: high

7. Sources

• The Hacker News — "Malware Can Abuse Windows Hello for Business Keys for Persistent Entra ID Access" — https://thehackernews.com/2026/08/malware-can-abuse-windows-hello-for.html — 2026-08-07
• The Hacker News — "New NatJack Attacks Hijack TCP Sessions and Spoof DNS by Manipulating NAT Tables" — https://thehackernews.com/2026/08/new-natjack-attacks-hijack-tcp-sessions.html — 2026-08-07 (context only; describes related Black Hat research, not the WHfB technique)

8. Adverse Trace position

This is a credible, well-documented technique from a recognised Entra ID researcher, but it is single-sourced and uncorroborated by independent replication or observed exploitation. The severity for EMEA financial services is elevated despite the absence of a CVE: the technique undermines the core assumption that hardware-bound, phishing-resistant credentials cannot be abused by session-level malware, and it enables 90-day persistence via PRT. Environments with strong device-state Conditional Access and compliance enforcement are at lower risk; those relying on phishing-resistant MFA strength alone are at higher risk. We will monitor for Microsoft's response, a CVE assignment, and any evidence of active exploitation. Clients should prioritise the P1 hunt query for WHfB sign-ins with empty device IDs and enforce device compliance policies where they are not already in place.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.