threat-intel
Malware Can Abuse Windows Hello for Business Keys for Persistent Entra ID Access
High
Summary
Researchers have discovered a vulnerability in Windows Hello for Business that allows malware running within a signed-in session to leverage the victim's hardware-backed authentication key to gain persistent access to Microsoft Entra ID. This bypasses traditional security measures and enables attackers to register devices, obtain PRTs, and potentially compromise cloud services, even without administrator privileges. While no active exploitation has been reported, the technique highlights a significant limitation in phishing-resistant authentication.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data