Malware Abuses Windows Hello for Business Key to Authenticate Microsoft Entra ID

A newly demonstrated technique shows how malware in a compromised Windows user session can abuse Windows Hello for Business (WHFB) cryptographic keys to authenticate to Microsoft Entra ID, enabling attackers to gain cloud access without the victim’s password, PIN, or biometric data. Windows Hello for Business is designed as a passwordless authentication system. It normally stores a user’s private key in the device’s Trusted Platform Module, or TPM, making the key difficult to export or steal. Users unlock access to that key with a PIN, fingerprint, facial recognition, or another local verification method. However, researcher Dirk-jan Mollema found that a process already operating within an active user session may be able to use...

Læs hele artiklen hos kilden.