Malware Can Abuse Windows Hello for Business Keys for Persistent Entra ID Access

Malware already running in a signed-in Windows session can silently use the victim’s Windows Hello for Business key to authenticate to Microsoft Entra ID. This can enable longer-term cloud access, registration of an attacker-controlled device, acquisition of a Primary Refresh Token (PRT), and addition of further authentication methods where tenant policies permit.