Windows Hello for Business Vulnerability: How Malware Can Silently Access Your Cloud Accounts

Introduction

A new security research has revealed a concerning vulnerability in Windows Hello for Business. Malware running on a signed-in Windows session can silently use your Windows Hello key to authenticate to Microsoft Entra ID (formerly Azure AD) — without needing your PIN, password, or biometric information.

This means that if malware is already on your computer, it can quietly access your cloud accounts and maintain long-term access. The worst part? You won't see any prompt or notification. No fingerprint scan. No PIN entry. Just silent, stealthy access.

What Is Windows Hello for Business?

Windows Hello for Business is Microsoft's biometric authentication system. It allows users to sign into their Windows devices and Microsoft cloud services using:

• PIN — A numeric or alphanumeric code
• Fingerprint — Biometric fingerprint scanning
• Face recognition — Windows Hello's facial recognition feature

This system is considered phishing-resistant because the authentication keys are stored securely in hardware (like a TPM chip) and never leave the device. This makes it much harder for hackers to steal credentials compared to traditional passwords.

However, this new vulnerability shows that even phishing-resistant authentication has its limits.

The Vulnerability: How It Works

Security researcher Dirk-jan Mollema discovered that malware already running on a signed-in Windows session can abuse Windows Hello for Business keys. Here is how the attack works:

• Step 1: A user is signed into their Windows device with Windows Hello for Business enabled.
• Step 2: Malware is already running on the device (perhaps from a phishing email or malicious download).
• Step 3: The malware requests the Windows Hello key through the WebAuthn API.
• Step 4: Windows signs the authentication request without requiring any user interaction.
• Step 5: The malware uses this signed authentication to access Microsoft Entra ID services.
• Step 6: The attacker can then register a new device, obtain a Primary Refresh Token (PRT), and maintain long-term cloud access.

Why This Matters for Your Business

This vulnerability is significant for several reasons:

• No user interaction required. The victim sees no prompt, PIN request, or biometric scan. The attack happens silently in the background.
• Works on TPM-backed systems. Even hardware-secured keys are vulnerable because the malware uses Windows' ticketing system to request authentication.
• No admin privileges needed. The malware only needs to run as the signed-in user, not as an administrator.
• Long-term persistence. The attacker can obtain a Primary Refresh Token (PRT) that remains valid for 90 days and is continuously renewed.
• Bypasses phishing-resistant authentication. Even though Windows Hello is considered phishing-resistant, malware inside the session can still abuse it.

This means that if an attacker gains access to a user's session (even through a simple phishing email), they could silently access your Microsoft cloud services for months without detection.

Technical Details

Here are the key technical findings from Mollema's research:

• Five-minute challenge window. The Entra ID challenge is valid for five minutes and is not bound to a specific session, user, or tenant. This allows attackers to request the challenge on another host and have the compromised endpoint produce the signed assertion.
• Token without device ID. The obtained token carries no device ID claim. This lets the attacker register a new device and request a PRT for it.
• WebAuthn bypass. The vulnerability treats the Windows Hello key as a FIDO2 passkey through WebAuthn, bypassing traditional authentication checks.
• Conditional Access bypass. The WebAuthn sign-in can satisfy Conditional Access policies requiring Microsoft's phishing-resistant authentication strength. It also counts as fresh multi-factor authentication.
• Device registration. Once the attacker has the token, they can register a new device and add further authentication methods where tenant policies allow.

How to Detect This Attack

Mollema recommends monitoring for Windows Hello for Business sign-ins with an empty device ID. These are the key indicators:

• Empty device ID in sign-in logs. Legitimate incognito or non-SSO browser sessions can produce the same pattern, but repeated occurrences should be investigated.
• Unexpected device registrations. Monitor for new devices being registered in your Entra ID environment.
• Unusual authentication patterns. Look for authentication requests coming from unexpected locations or during unusual hours.

You can use Microsoft's Azure AD Sign-in logs and Audit logs to check for these indicators.

How to Protect Your Business

While this vulnerability is concerning, there are steps you can take to protect your organization:

• Implement Conditional Access policies. Require device compliance and other conditions for authentication. This can stop the attack chain even if the token is stolen.
• Monitor for unexpected device registrations. Regularly review your Entra ID device list for unknown devices.
• Use Windows Defender and EDR solutions. Monitor for suspicious activity and malware that could be used to exploit this vulnerability.
• Educate employees. Train staff to recognize phishing attempts and other malware delivery methods.
• Regularly review sign-in logs. Look for patterns that might indicate abuse.
• Consider additional authentication layers. Where possible, implement additional checks beyond phishing-resistant authentication.
• Keep systems updated. While there is no specific patch for this issue, general updates improve overall security posture.

Microsoft has not released a specific patch for this issue, as Mollema describes it as a "consequence of how Windows Hello for Business works." However, Microsoft documentation does recommend monitoring for unexpected device registrations as a detection method.

Final Thoughts

The Windows Hello for Business vulnerability highlights an important security reality: even the best authentication methods have limitations. Phishing-resistant authentication is a powerful tool, but it is not a silver bullet.

When malware is already running on a signed-in session, it can abuse legitimate Windows features to access cloud services without user interaction. This is why defense-in-depth is so important.

Key takeaways:

• Malware can silently use Windows Hello for Business keys without user interaction
• No PIN, password, or biometric prompt is required
• Attackers can obtain long-term cloud access (up to 90 days)
• Monitor for empty device IDs in sign-in logs
• Use Conditional Access policies as an additional layer of protection
• Keep your EDR and antivirus tools up to date

If you need help securing your Microsoft cloud environment or want to learn more about protecting your business from vulnerabilities like this, contact SystemLogicIT for a free security assessment.