Malware Can Hijack Windows Hello Keys to Break Into Microsoft Cloud Accounts

Malware can exploit Windows Hello keys to access Microsoft Entra ID without passwords, raising security concerns for device registrations.

By Content Team

Aug 8, 2026

ON THIS PAGE

Security researcher Dirk-jan Mollema has uncovered a technique that lets malware abuse Windows Hello for Business cryptographic keys to authenticate into Microsoft Entra ID — no password, PIN, or fingerprint needed.

The attack works by exploiting an already-unlocked user session. Malware running in that session can trigger cryptographic signing operations through Windows interfaces, then use those signatures to request Primary Refresh Tokens or generate WebAuthn assertions — effectively impersonating the victim in Microsoft's cloud.

The resulting access tokens often lack a device identifier, letting attackers register new devices, add authentication methods, and establish persistence. Defenders should flag Entra ID sign-ins where the device ID is empty and watch for unexpected device registrations.

Source: Cybersecurity News

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?