Back Feeds.4Sysops

Malware can turn Windows Hello keys into persistent Entra ID access

Feeds.4Sysops •IT News • August 7, 2026

Malware running inside a user’s signed-in Windows session can invoke Windows Hello for Business keys without stealing the PIN, extracting a TPM key, or triggering biometric approval. The resulting authentication may satisfy phishing-resistant MFA and let attackers register their own device, obtain long-lived Entra ID tokens, and add credentials where tenant policies permit. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Malware Exploits Windows Hello Keys for Unauthorized Microsoft Entra ID Access A recently disclosed technique allows malware running in a Windows user session to exploit Windows Hello for Business (WHFB) keys to authenticate to Microsoft Entra ID. This method enables attackers to gain access without needing the victim's PIN, biometric data, or password. The attack can satisfy phishing-resistant multi-factor authentication (MFA), allowing attackers to register their own devices and obtain long-lived Entra ID tokens. This vulnerability affects organizations using Microsoft Entra ID and poses a significant risk as it can bypass traditional security measures. The research highlights the potential for persistent access through compromised user sessions, raising alarms among cybersecurity professionals. Current status indicates that no patches or mitigations have been publicly released yet. 4 sources 62

Extracted Entities

Malware can turn Windows Hello keys into persistent Entra ID access

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

Platforms (3)