Local Malware Can Weaponize Windows Hello for Business to Hijack Entra ID Access
Research shows that while Windows Hello for Business stops remote phishing, it cannot prevent local malware from abusing hardware keys to secure persistent cloud access.
Security researcher Dirk-jan Mollema has demonstrated that malware executing within an active Windows session can silently abuse Windows Hello for Business (WHfB) keys to authenticate to Microsoft Entra ID. This discovery reveals a critical gap in the 'phishing-resistant' security model by attacking the endpoint after a user has already successfully authenticated.
The attack leverages the Microsoft Passport Key Storage Provider to sign authentication requests using the victim's WHfB keys. Because the user is already signed in, the malware can request these signatures without requiring further user interaction. Once authenticated, the attacker can obtain a Primary Refresh Token (PRT), the essential credential used for single sign-on (SSO) and maintaining persistent access to cloud resources across an organization's Entra ID tenant.
The Phishing-Resistant Paradox
Windows Hello for Business is widely marketed as a gold standard for identity security because it replaces passwords with hardware-backed keys stored in a Trusted Platform Module (TPM) and requires biometrics or a PIN for access. This architecture effectively eliminates remote phishing attacks, as there is no password or one-time code for a user to accidentally reveal to a fraudulent website.
However, Mollema's research highlights that this protection is focused on the authentication event itself rather than the ongoing session. While the TPM protects the private key from being stolen or exported, it does not prevent a malicious process running on the same machine from asking the TPM to sign a request on the attacker's behalf while the session is active.
The 'Last Mile' Security Gap
This vulnerability undermines the industry assumption that migrating to passwordless, phishing-resistant authentication completely eliminates the risk of account takeover. It exposes a fundamental 'last mile' problem: the security of the identity is only as strong as the security of the endpoint.
If a device is compromised by local malware, the very hardware protections designed to secure the identity can be weaponized. By securing a PRT, an attacker transforms a temporary endpoint infection into long-term, high-trust access to the cloud environment, bypassing the MFA protections that were intended to keep unauthorized users out.
Future Outlook
As organizations continue to push toward Zero Trust architectures, this research suggests that device health and endpoint integrity must be verified continuously, not just at the moment of login. Security teams should monitor for anomalous authentication patterns and the unexpected generation of PRTs. It remains to be seen how Microsoft will evolve the WHfB architecture to better isolate key usage from potentially compromised user-mode processes.