Executive Summary
Security researcher Dirk-jan Mollema has demonstrated a technique where malware residing in an active Windows session can silently invoke Windows Hello for Business (WHfB) keys to authenticate to Microsoft Entra ID. This method exploits the Windows ticketing system, which keeps private-key operations available while a user is signed in, allowing an attacker to generate signed assertions without extracting the private key, knowing the PIN, or triggering biometric prompts.
Technically, the attack treats the WHfB key as a FIDO2 passkey through WebAuthn, bypassing session or tenant binding of Entra ID challenges. This allows an attacker to obtain tokens that lack device ID claims, which can subsequently be used to register new attacker-controlled devices and obtain a Primary Refresh Token (PRT). Because the sign-in satisfies phishing-resistant MFA requirements, it can be used to bypass sophisticated Conditional Access policies.
This finding is significant because it highlights a critical limitation in hardware-bound, phishing-resistant authentication: while the credential cannot be stolen, it can be remotely 'borrowed' by malicious code already on the system. Organizations should focus on monitoring device registration patterns and enforcing strict device compliance policies to mitigate the risk of long-term persistence via this method.