Windows Hello Key Abuse Lets Attackers Access Microsoft Entra ID Accounts

Gbhackers •Divya • August 7, 2026

Security researcher has disclosed a technique involving Windows Hello for Business (WHFB) that could allow attackers with access to an active Windows user session to authenticate to Microsoft Entra ID services without needing the victim’s PIN, biometric verification, or password. Mollema’s research demonstrates how attackers can effectively “borrow” the cryptographic key that underlies Windows Hello […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Malware Exploits Windows Hello Keys for Unauthorized Microsoft Entra ID Access A recently disclosed technique allows malware running in a Windows user session to exploit Windows Hello for Business (WHFB) keys to authenticate to Microsoft Entra ID. This method enables attackers to gain access without needing the victim's PIN, biometric data, or password. The attack can satisfy phishing-resistant multi-factor authentication (MFA), allowing attackers to register their own devices and obtain long-lived Entra ID tokens. This vulnerability affects organizations using Microsoft Entra ID and poses a significant risk as it can bypass traditional security measures. The research highlights the potential for persistent access through compromised user sessions, raising alarms among cybersecurity professionals. Current status indicates that no patches or mitigations have been publicly released yet. 4 sources 62

Extracted Entities

Platforms (1)

Windows Hello For Business