🟠 High | Source: The Hacker News
Security researcher Dirk-jan Mollema has shown that malware running in an active Windows session can silently hijack a user’s Windows Hello for Business key to authenticate to Microsoft Entra ID without any user interaction. From there, an attacker can register a rogue device, obtain a Primary Refresh Token (PRT), and add their own authentication methods — effectively establishing persistent cloud access. This is significant because it turns endpoint compromise into a durable cloud identity takeover, bypassing typical MFA assumptions.
Security Architect’s Take: Review Entra ID Conditional Access policies to enforce compliant device checks and restrict PRT issuance to managed devices only; additionally, monitor for anomalous device registrations and new authentication method additions via Entra ID audit logs and Microsoft Defender for Identity alerts. Consider enforcing Conditional Access policies that block authentication from unmanaged or newly registered devices as a priority mitigation.
Original advisory: Malware Can Abuse Windows Hello for Business Keys for Persistent Entra ID Access