Malware Exploits Windows Hello Keys for Unauthorized Microsoft Entra ID Access

• •Malware can exploit Windows Hello keys for unauthorized Entra ID access.
• •Attackers can bypass PIN and biometric verification to authenticate.
• •The technique allows for persistent access and device registration.

A recently disclosed technique allows malware running in a Windows user session to exploit Windows Hello for Business (WHFB) keys to authenticate to Microsoft Entra ID. This method enables attackers to gain access without needing the victim's PIN, biometric data, or password. The attack can satisfy phishing-resistant multi-factor authentication (MFA), allowing attackers to register their own devices and obtain long-lived Entra ID tokens. This vulnerability affects organizations using Microsoft Entra ID and poses a significant risk as it can bypass traditional security measures. The research highlights the potential for persistent access through compromised user sessions, raising alarms among cybersecurity professionals. Current status indicates that no patches or mitigations have been publicly released yet.