Malware Can Hijack Windows Hello Keys to Break Into Microsoft Cloud Accounts

Malware can exploit Windows Hello keys to access Microsoft Entra ID without passwords, raising security concerns for device registrations.

By Content Team

Aug 8, 2026

ON THIS PAGE

Security researcher Dirk-jan Mollema has uncovered a technique that lets malware abuse Windows Hello for Business cryptographic keys to authenticate into Microsoft Entra ID — no password, PIN, or fingerprint needed.

The attack works by exploiting an already-unlocked user session. Malware running in that session — with no admin rights required — can trigger cryptographic signing operations through Windows interfaces, then use those signatures to request Primary Refresh Tokens or generate WebAuthn assertions, effectively impersonating the victim in Microsoft's cloud.

Tokens issued through the WebAuthn path carry no device identifier, letting attackers register new devices, add authentication methods, and establish persistence. There is no patch and no CVE: Mollema describes the behaviour as a consequence of how Windows Hello for Business works, and it has been left as-is, so monitoring is the only mitigation.

Defenders should flag Entra ID sign-ins where the device ID is empty — expecting some false positives from legitimate incognito and non-SSO browser sessions — and watch for unexpected device registrations.

Source: Cybersecurity News

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?