Windows Hello for Business is designed to reduce password risk by using strong cryptographic keys for authentication. However, recent research has shown that if an attacker already has access to a signed-in Windows session, they may be able to abuse those Windows Hello for Business keys to silently authenticate to Microsoft Entra ID (formerly Azure Active Directory). For small businesses that rely heavily on Microsoft 365, this risk can translate into long-lived, hard-to-detect cloud account compromise.
This article explains what is happening, why it matters, and what practical steps small organizations and technical owners can take to reduce their exposure.
Key Takeaways
- Malware running in an already signed-in Windows session can potentially use the victim’s Windows Hello for Business key to authenticate to Microsoft Entra ID without user interaction.
- Once authenticated, attackers can establish longer-term cloud access, including registering their own device, acquiring a Primary Refresh Token (PRT), and adding new authentication methods.
- This is not a failure of cryptography; it is a misuse of a legitimate key from within a trusted session.
- Effective defenses focus on endpoint security, hardening identity policies, and monitoring for suspicious device and authentication-method changes.
- Small businesses should treat identity and endpoint protection as core parts of their security strategy, not optional add-ons.
What Is Windows Hello for Business and Entra ID?
To understand the risk, it helps to clarify two core components:
Windows Hello for Business
Windows Hello for Business replaces passwords with cryptographic key pairs stored securely on a user’s device. The user unlocks the private key using biometrics (face recognition, fingerprint) or a PIN. The key is then used to authenticate the user to services such as Microsoft Entra ID.
Benefits include:
- No password to steal in transit or via password databases.
- Key material stays on the device, protected by hardware (such as TPM) where available.
- Reduced exposure to traditional phishing.
Microsoft Entra ID
Microsoft Entra ID is Microsoft’s cloud identity and access management platform. It powers sign-in and authorization for Microsoft 365, Azure, and many third-party applications integrated with it.
When a user signs in, Entra ID can issue tokens that allow access to cloud resources without prompting for credentials every time. One of the most important of these is the Primary Refresh Token (PRT), which devices use to obtain new access tokens.
The Core Issue: Malware Using Legitimate Hello Keys
Security researcher Dirk-jan Mollema demonstrated that malware already running in a signed-in Windows session can silently use the victim’s Windows Hello for Business key to authenticate to Microsoft Entra ID. This is a critical nuance: the attacker does not break the key system from the outside; they take advantage of its normal behavior from inside a compromised session.
How the Abuse Works at a High Level
At a conceptual level, the abuse follows this pattern:
- Session Compromise: The attacker gains code execution within a user’s active Windows session (e.g., via malware, a malicious document, or exploit).
- Silent Key Usage: Because the user is already signed in and the device is considered trusted, the malware can trigger operations that use the Windows Hello for Business authentication keys without requiring the user to re-enter a PIN or use biometrics.
- Cloud Authentication: Using those keys, the malicious process can authenticate to Microsoft Entra ID as the victim, just like any legitimate client or app would.
- Persistent Access Setup: Once authenticated, the attacker can perform actions to maintain long-term access, even after the original malware is removed.
From a purely technical perspective, this is expected behavior: Windows Hello for Business is meant to let authenticated processes act on behalf of the user. The risk arises when an attacker becomes one of those processes.
Why This Matters: From Local Compromise to Persistent Cloud Access
The real danger is not just that an attacker logs in once to Entra ID. It is that they can bootstrap a much more persistent and stealthy foothold in your cloud environment.
Device Registration Under Attacker Control
With sufficient permissions and a valid session, the attacker can register a device that they control as a trusted or compliant device in your Entra ID tenant or connected device management system. That new device may then:
- Receive tokens with similar access levels as the victim’s original device.
- Bypass some conditional access policies that rely on device trust or compliance status.
- Remain in place even if the original compromised endpoint is rebuilt or replaced.
Obtaining a Primary Refresh Token (PRT)
Once authenticated, the attacker can obtain a Primary Refresh Token (PRT) for their own device or session. A PRT allows the holder to:
- Request new access tokens for various Microsoft cloud services without user interaction.
- Maintain access over an extended period, depending on your token lifetime and revocation policies.
- Potentially survive password changes if you do not have strict token revocation and sign-out policies in place.
Adding Additional Authentication Methods
With the right permissions and account configuration, a compromised session can be used to register new authentication methods for the account, such as:
- New phone numbers for SMS or voice MFA.
- New app-based authenticators.
- Security keys or other strong authentication devices.
If an attacker succeeds in adding their own method, they can often continue logging in as the user, even if the user later changes their password. This is one path to durable account takeover.
What This Is Not: A Broken Encryption Scheme
It is important for small business owners and technical leads to understand that this research does not mean Windows Hello for Business or Entra ID encryption is “broken.” The cryptographic protections still function as designed.
The problem is key misuse from inside a trusted context. Once malware is running with the user’s permissions in an active session, the attacker can misuse almost any capability available to that user. In this case, one such capability is the ability to authenticate silently to Entra ID using Windows Hello for Business keys.
This pattern is common across security incidents: most major cloud or identity compromises begin with a local foothold (phishing, malware, or browser session hijacking) that is then leveraged to gain stronger and more persistent access to cloud resources.
Practical Risk Reduction for Small Businesses
You cannot fully prevent attackers from trying to exploit trusted sessions, but you can make it harder for them to succeed and easier to detect when something goes wrong.
1. Strengthen Endpoint Security
- Use modern endpoint protection (EDR/XDR) that can detect anomalous behavior, code injection, and suspicious process activity.
- Keep Windows and all applications patched to reduce exploit opportunities.
- Limit local administrator rights; most users should not have full control over their machines.
- Harden browser and email security to reduce the odds of malicious attachments or links leading to a session compromise.
2. Tighten Entra ID Conditional Access Policies
- Require multi-factor authentication (MFA) for high-value actions, not just sign-in (e.g., adding new authentication methods, device registration, or admin role activation).
- Use conditional access to limit sign-ins from unfamiliar locations, platforms, or device states.
- Review and minimize which accounts are allowed to join or register devices.
3. Monitor for Suspicious Identity Changes
- Alert on new device registrations, especially when they occur from unusual IP addresses or geographies.
- Track changes to MFA methods, phone numbers, and authenticator apps associated with user accounts.
- Review sign-in logs for strange patterns, such as rapid logins from multiple regions or devices.
4. Treat Tokens and Device Trust as Critical Assets
- Configure sign-out and token revocation procedures for incidents, including revoking refresh tokens (such as PRTs) when you suspect compromise.
- Regularly review and prune stale devices that no longer need access.
- Ensure that only managed, compliant devices are granted access to critical data where feasible.
5. Educate Users About Session Risk
- Explain that a “trusted device” is powerful: leaving a signed-in session unattended can expose accounts to abuse if the device is compromised.
- Encourage users to lock their screens when stepping away from their desks.
- Train staff to report unusual prompts, new MFA registrations they did not perform, or unexpected device enrollment notifications.
Balancing Convenience and Security
Windows Hello for Business and Microsoft Entra ID exist to make security usable: fewer passwords, better user experience, and strong cryptography under the hood. The research into malware abusing Hello keys does not negate these benefits, but it does highlight the trade-offs involved when convenience features operate inside a compromised environment.
For small businesses that depend on Microsoft 365 and related services, the lesson is clear: cloud identity and endpoint security cannot be treated separately. A compromised Windows session can quickly become a compromised Entra ID account, and from there, a compromised cloud tenant.
By combining strong endpoint protection, carefully designed identity policies, and continuous monitoring of device and authentication changes, you can significantly reduce the likelihood that an attacker will turn a single infected machine into a long-lived foothold in your cloud environment.
Next Steps for Your Business
If your organization relies on Microsoft 365 and Windows devices, now is a good time to:
- Review your Entra ID conditional access and MFA policies.
- Audit device registrations and remove those you no longer trust or need.
- Confirm that you have a documented process to revoke tokens and force re-authentication during incidents.
- Evaluate whether your current endpoint protection is capable of detecting the types of behaviors described above.
If you would like expert help aligning your website, applications, and authentication flows with modern security practices, Izende Studio Web can support you with practical, implementation-focused guidance.
Explore Izende Studio Web security-focused services to strengthen your digital operations.