Malware Abuses Windows Hello for Business Key to Authenticate Microsoft Entra ID

Severity

Medium

Detail

A newly demonstrated attack technique shows that malware running within a compromised Windows user session can abuse Windows Hello for Business (WHFB) cryptographic keys to authenticate to Microsoft Entra ID without requiring the victim’s password, PIN, or biometric authentication. The technique could allow attackers to obtain cloud access, establish persistence, and potentially register attacker-controlled devices or authentication methods.

Windows Hello for Business is a passwordless authentication mechanism that normally protects a user’s private key within the device’s Trusted Platform Module (TPM). Access to the key is typically protected by a PIN, fingerprint, facial recognition, or another local authentication method. However, research by security researcher Dirk-jan Mollema demonstrated that malware already operating within an active and unlocked user session may be able to invoke Windows cryptographic interfaces and request cryptographic signing operations using the protected WHFB key without triggering a new PIN or biometric prompt.

How?

The technique does not require attackers to extract or copy the TPM-protected private key. Instead, malware running under the compromised user’s session can use Windows cryptographic functionality to perform signing operations with the WHFB key. The resulting signatures can then be used as proof of possession of the Windows Hello credential during Microsoft Entra ID authentication flows.

One attack path involves requesting a Primary Refresh Token (PRT), an important Microsoft Entra ID authentication artifact that supports single sign-on across Microsoft services and applications. Because PRTs can provide persistent cloud access and may be renewed, they are valuable targets for attackers seeking long-term access to enterprise environments.

The research also demonstrates that the Windows Hello for Business key can potentially be used as a FIDO2 passkey through the WebAuthn authentication protocol. By generating a valid WebAuthn assertion using the victim’s WHFB key, an attacker may authenticate to Microsoft Entra ID from a separate machine without possessing the victim’s password, PIN, or biometric information.

The resulting authentication tokens may not contain the expected device identifier associated with the victim’s original Windows device. Attackers could potentially leverage this condition to register a new attacker-controlled device within Entra ID and subsequently attempt to obtain additional authentication tokens, establish persistence, or add new authentication methods such as passkeys.

This technique also presents challenges for Conditional Access policies. Since Windows Hello and FIDO2 are considered phishing-resistant authentication mechanisms, authentication performed using a compromised WHFB session may satisfy policies requiring strong authentication. Policies requiring compliant or managed devices may provide additional protection, although attackers who obtain cloud access could attempt further techniques to bypass device-based restrictions.

Recommendation

Organizations should implement the following measures to mitigate the risk associated with this technique:

• Monitor Microsoft Entra ID sign-in logs for unusual Windows Hello for Business authentications, particularly events where the device ID is absent, unexpected, or inconsistent with the user’s normal activity.
• Investigate unexpected device registrations, newly added authentication methods, unusual authentication-token or PRT activity, and suspicious sign-in events occurring shortly after an endpoint compromise.
• Enforce Conditional Access policies requiring compliant or managed devices where appropriate to reduce the risk of unauthorized access from attacker-controlled devices.
• Protect active and unlocked Windows sessions by enforcing automatic screen-lock policies.

Source

https://cybersecuritynews.com/malware-abuses-windows-hello-key/