Loading story…
Security research has shown that attackers with low-privilege access to an active Windows user session can abuse Windows Hello for Business (WHFB) keys to authenticate to Microsoft Entra ID without the victim’s PIN, biometrics, or other presence checks. By invoking native Windows cryptographic interfaces from the compromised session, an attacker can use the victim’s hardware-backed key to sign authentication data, obtain Primary Refresh Tokens (PRTs), and generate WebAuthn/FIDO2 assertions. Related research presented on attacking PRTs through their macOS implementation underscores broader interest in how platform-specific authentication flows can be leveraged to access cloud identity tokens.
The Windows technique is described as a design-level weakness rather than a newly patched vulnerability, in part because WHFB supports scenarios such as Remote Desktop where direct user presence is not always enforced. The researcher also demonstrated that WHFB keys can function as passkeys to obtain tokens lacking a device ID claim, which can then be used to register a new device and establish persistence in the tenant. Defenders are advised to monitor Entra ID sign-ins that show Windows Hello for Business authentication without an associated device ID and to investigate suspicious new device registrations tied to affected accounts.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
At Black Hat USA 2026, SpecterOps presented 'Pass-the-Passkey,' describing a Windows and Microsoft Entra ID attack chain in which retained authentication signatures could be replayed to impersonate privileged users while satisfying phishing-resistant MFA requirements. The Windows component was tracked as CVE-2026-34348, and Microsoft said it released a security update and applied mitigations for the reported issue.
A researcher described a technique to use Windows Hello for Business keys from a compromised user session to authenticate to Microsoft Entra ID, request Primary Refresh Tokens, and perform WebAuthn/FIDO2 authentication without the user's PIN or biometrics. The post also says minimal WebAuthn support was added to ROADtools and roadtx to enable WHFB-based authentication and outlines persistence via new device registration.
A Security Friends Research Blog post described a phishing technique targeting Windows Hello for Business. This represents an earlier technical disclosure related to WHFB abuse that predates the later Entra ID key-abuse and tooling research.
The researcher states that Microsoft fixed older Entra ID behavior that had allowed an existing device's Primary Refresh Token to be used to create a new device identity after it was reported.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcethehackernews.com
Open sourcecybersecuritynews.com
Open sourcethehackernews.com
Open sourcedirkjanm.io
Open sourceblog.fndsec.net
Open sourcetroopers.de
Open sourcelearn.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SpecterOps disclosed a **"Pass-the-Passkey"** attack family that can undermine passkey-based authentication in **Windows 11** and **Microsoft Entra ID** without extracting private keys from hardware tokens or trusted enclaves. The most serious chain used Windows 11 event logging that recorded full WebAuthn assertion responses and paired it with Entra ID replay-validation weaknesses, allowing attackers to replay harvested assertions and gain access to privileged cloud accounts while still meeting phishing-resistant MFA checks. Microsoft addressed the Windows logging exposure as **`CVE-2026-34348`**, truncating logged signature fields to six bytes. The research also described local attack paths that abuse legitimate WebAuthn APIs for prompt flooding, application identity spoofing, remote desktop pass-through, and Credential UI spoofing, enabling local passkey phishing and user-fatigue scenarios. Researchers released open-source tooling to help defenders test for assertion injection, event-log mining, and WebAuthn API hooking, and recommended patching Windows 11, enforcing server-side anti-replay protections, monitoring WebAuthn API activity, and requiring hardware-backed attestation for high-privilege Entra ID accounts.
Aug 10, 2026
Microsoft is rolling out **passkey support for Microsoft Entra on Windows devices**, enabling *phishing-resistant*, passwordless sign-in using **Windows Hello** (face, fingerprint, or PIN). The capability is **opt-in** and is scheduled to enter **public preview from mid-March through late April 2026** for worldwide tenants, with **government cloud environments** (GCC, GCC High, DoD) following in a later window. A key security impact is that Entra passkeys extend passwordless authentication to **unmanaged Windows devices** (e.g., personal/shared endpoints) that previously often fell back to passwords. Microsoft states the passkeys are **device-bound** and stored in the Windows Hello container; they are **cryptographically bound to the device** and **not transmitted over the network**, reducing exposure to credential phishing and certain malware-based theft scenarios used to bypass MFA. Each Entra account registers its own passkey per device (multiple accounts can coexist on one machine), but passkeys **do not sync across devices**, requiring separate registration per device. For preview enrollment, administrators must enable the **Passkeys (FIDO2)** authentication method in Entra Authentication Methods policies, create a passkey profile with the required Windows Hello **AAGUIDs**, and assign it to the appropriate groups.
Jun 29, 2026
Researchers reported that Microsoft Entra ID’s legacy WS-Trust autologon endpoint for Seamless SSO can be abused to conduct password-spraying attacks with reduced defensive visibility. Testing found the `usernamemixed` endpoint remained reachable for older Office 2013-era clients, did not appear to trigger expected Smart Lockout protections, and omitted failed attempts from standard Entra ID sign-in logs. The endpoint also returned distinct `AADSTS` error codes that let attackers distinguish invalid passwords from valid credentials that were later blocked by MFA or Conditional Access, enabling efficient credential validation without full account access. The activity aligns with ATT&CK techniques for **Password Spraying** and abuse of **Valid Accounts**, including default or legacy authentication paths that permit legitimate-looking logons once credentials are known. Defenders were advised to disable the WS-Trust `usernamemixed` endpoint, block legacy authentication through Conditional Access, monitor the Unified Audit Log for autologon requests, and use detections for repeated failed logons from a single IP across multiple users—similar to Okta analytics that flag more than five invalid authentication attempts from one source as suspicious spraying behavior.
Aug 12, 2026