Dominic Jainy brings a wealth of experience in modern infrastructure, often dissecting how emerging technologies like artificial intelligence and blockchain intersect with core identity security. Today, we explore a critical vulnerability in Windows Hello for Business, where researchers have discovered that hardware-bound keys—previously thought to be the gold standard of phishing resistance—can be manipulated by local malware to gain persistent access to Entra ID. We will delve into the mechanics of Windows ticketing, the clever abuse of WebAuthn to bypass traditional session boundaries, and why a hardware-bound credential is not a silver bullet against a determined adversary who has already bypassed the initial perimeter.
How does the mechanism of Windows ticketing allow malware to perform private-key operations on a TPM-backed system without the user ever realizing something is wrong?
It feels like a betrayal of trust when a system designed for security becomes the very conduit for an attack. On these TPM-backed systems, the malware doesn’t need to do the heavy lifting of extracting a private key or cracking a PIN because Windows essentially leaves the door unlocked while you work. Through a process called ticketing, the operating system keeps those private-key operations available for use as long as the user is interactively signed in. This means any code running in that session can simply ask Windows to sign authentication data on its behalf, effectively piggybacking on the user’s identity. The most unsettling part is that this requires absolutely no administrator privileges, allowing a silent, low-privilege process to compromise the entire cloud identity of the user without ever triggering a biometric prompt.
When we look at the transition from a local compromise to a full cloud takeover, how does treating a Windows Hello key as a FIDO2 passkey change the game for an attacker?
This is where the researcher Dirk-jan Mollema really showed the ingenuity of modern threat actors during his presentation at DEF CON 32 in 2024. By treating the Windows Hello for Business key as a FIDO2 passkey through WebAuthn, an attacker can decouple the authentication from the physical device in a way that feels almost like magic. They exploit a loophole where the Entra ID challenge—which stays valid for a short 5-minute window—is not strictly bound to a specific session or tenant. This allows an attacker to request a challenge on their own machine and then have the victim’s compromised endpoint produce the signed assertion needed to win the prize. Once they have that assertion, they can use tools like the ROADtools framework to request tokens or even open a full browser session, effectively stepping into the victim’s digital shoes with terrifying ease.
What are the long-term implications of an attacker obtaining a Primary Refresh Token through this method, and how does it facilitate persistent access?
Once an attacker secures a Primary Refresh Token, the clock starts ticking, but it is a very long clock that favors the adversary. A PRT remains valid for 90 days and, even more concerning, it is continuously renewed as long as the user stays active on the device. Because the token generated through this WebAuthn bypass often carries no device ID claim, the attacker can use it to register a completely new device under their own control. This creates a bridge to the cloud that does not disappear when the initial malware is cleaned up from the original machine. By satisfying the requirements for fresh multi-factor authentication, the attacker can even go as far as adding new passkeys or additional Windows Hello keys to the account, cementing their presence in the environment for the long haul.
Given that this technique does not trigger traditional security alarms, what should security teams be looking for to detect this type of abuse?
Detection is a subtle game of cat and mouse because the attacker’s footprints often look exactly like legitimate user behavior. The most effective strategy recommended by the research is to hunt for Windows Hello for Business sign-ins that specifically show an empty device ID, which is a massive red flag in a standard corporate deployment. However, it is not a perfect signal; IT teams have to sift through the noise, as legitimate incognito browser sessions or non-SSO logins can sometimes produce the same pattern. Beyond just looking at logs, there needs to be a heightened sense of urgency around monitoring unexpected device registrations within the tenant. If a new, unrecognized device suddenly appears using a hardware-bound credential that should have been locked to a physical workstation, you know you have a serious problem on your hands.
What is your forecast for the future of hardware-bound identity security?
I believe we are entering an era where the industry will have to admit that hardware-bound credentials are only as secure as the operating system session they inhabit. In the coming years, we will likely see a shift toward mandatory binding for every single challenge-response pair, ensuring that a 5-minute window or a missing device ID can no longer be exploited to jump between hosts. We can expect Microsoft and other major identity providers to introduce stricter device-state or compliance policies that can interrupt these chains, even if the MFA itself is technically valid. Ultimately, the battle will move from protecting the key itself to protecting the execution environment that has the permission to use it, as the “phishing-resistant” label begins to lose its shine against local execution threats.