TotalRecall Exposes Decrypted Windows Recall Data Through AIXHost Injection

Researchers released TotalRecall Reloaded, a proof-of-concept attack that targets Microsoft Windows Recall by injecting into AIXHost.exe, the process that handles Recall content after Windows Hello authentication. The report says Recall’s advertised protections—VBS enclaves, AES-256-GCM encryption, TPM-backed keys, and secure handling in aihost.exe—remain in place, but decrypted screenshots, OCR text, metadata, named entities, and activity descriptions become accessible once they are passed to the less-protected rendering process. According to the researchers, malware running in the same user context can use DLL injection and internal COM interfaces to extract a detailed history of user activity, including messages, emails, documents, browsing context, timestamps, and AI-generated summaries, without administrator privileges or kernel exploits.

The findings add to long-running privacy and security concerns around Recall, which Microsoft had previously delayed after criticism that the feature continuously captures on-screen activity and stores searchable local history. Earlier reporting highlighted fears that Recall could collect sensitive content such as passwords and maintain it in locally accessible databases, even as Microsoft defended the design as on-device and privacy-conscious. In the new case, researchers also reported pre-authentication exposure of recent thumbnails, deletion of Recall history without Windows Hello checks, and alternate COM paths that allegedly bypass intended restrictions; they said the issues were disclosed to Microsoft in March 2026, but Microsoft closed the case as "Not a Vulnerability", stating the demonstrated behavior matched Recall’s documented security model rather than crossing a security boundary.