Windows Hello Key Abuse Enables Entra ID Token Theft and Persistence

Security research has shown that attackers with low-privilege access to an active Windows user session can abuse Windows Hello for Business (WHFB) keys to authenticate to Microsoft Entra ID without the victim’s PIN, biometrics, or other presence checks. By invoking native Windows cryptographic interfaces from the compromised session, an attacker can use the victim’s hardware-backed key to sign authentication data, obtain Primary Refresh Tokens (PRTs), and generate WebAuthn/FIDO2 assertions. Related research presented on attacking PRTs through their macOS implementation underscores broader interest in how platform-specific authentication flows can be leveraged to access cloud identity tokens.

The Windows technique is described as a design-level weakness rather than a newly patched vulnerability, in part because WHFB supports scenarios such as Remote Desktop where direct user presence is not always enforced. The researcher also demonstrated that WHFB keys can function as passkeys to obtain tokens lacking a device ID claim, which can then be used to register a new device and establish persistence in the tenant. Defenders are advised to monitor Entra ID sign-ins that show Windows Hello for Business authentication without an associated device ID and to investigate suspicious new device registrations tied to affected accounts.