Windows Hello for Business credentials can be borrowed by malware running in a signed-in session to reach Microsoft Entra ID, opening a persistence channel that can last 90 days. Researcher Dirk-jan Mollema demonstrated the technique, which needs no admin rights and never extracts the underlying private key.
The mechanism exploits a Windows behavior: while a user is interactively signed in, the OS keeps private-key operations available, so code running as the user can request signed authentication data. On TPM-backed machines the key stays put in hardware, the PIN stays secret, and no biometric prompt ever fires. Mollema characterizes the behavior as inherent to how Windows Hello for Business works, and no vendor fix or CVE has been issued.
The novel step treats the credential as a FIDO2 passkey via WebAuthn. Because the five-minute Entra ID challenge is not bound to a session, user, or tenant, an attacker can request it from another machine and have the compromised endpoint produce the signed assertion. The token lacks a device ID claim, so the attacker can register a device it controls and obtain a Primary Refresh Token that stays valid for 90 days and renews with active use.
The sign-in can satisfy Conditional Access policies requiring phishing-resistant authentication and counts as fresh multi-factor authentication, allowing the attacker to add passkeys or new Hello keys where tenant policy permits. Tenant policies around device state or compliance can still cut the chain short, so the full persistence path will not survive in every setup.
Mollema reported no active exploitation. Detection guidance centers on Windows Hello for Business sign-ins with an empty device ID and on unexpected device registrations. Proof-of-concept scripts are available in the ROADtools repository, and the work extends passkey-abuse research presented at DEF CON in 2024.
