Identity Security Threat: Malware Weaponizes Windows Hello for Business Keys to Bypass MFA and Password Resets
Executive Summary
New cybersecurity research highlights a sophisticated persistence technique where local malware misuses asymmetric cryptographic keys generated by Windows Hello for Business (WHfB). By programmatically requesting signature operations from local Key Storage Providers (KSP) while an active user session is unlocked, malware can request Entra ID (Azure AD) primary refresh tokens (PRTs) or Active Directory Kerberos ticket-granting tickets (TGTs). This allows threat actors to maintain persistent, authenticated access across enterprise cloud and hybrid environments that survives traditional password resets and evades multi-factor authentication (MFA) prompts.
Deep-Dive Technical Analysis
Windows Hello for Business is Microsoft's flagship passwordless authentication technology, relying on public-private key pairs or X.509 certificates generated within a Trusted Platform Module (TPM) or software Key Storage Provider.
Exploitation Mechanics & Crypto Abuses
1. Context Harvesting: Once malware gains execution context under a logged-in user account (e.g., via phishing or infostealer payload), it enumerates available cryptographic containers managed by the Microsoft Software Key Storage Provider (Microsoft Software Key Storage Provider or Microsoft Platform Crypto Provider).
2. Silent Signing Requests: While the user unlocks their device using a PIN or biometrics, WHfB keys are placed in an active state. The malware uses standard CNG (Cryptography Next Generation) or NCrypt API calls (NCryptOpenStorageProvider, NCryptOpenKey, NCryptSignHash) to issue signing requests using the user's WHfB private key without triggering additional biometric prompts.
3. Primary Refresh Token (PRT) Request: The malware formats an OAuth/OIDC authentication challenge request to Entra ID's login.microsoftonline.com endpoint. By providing a nonce signed by the user's WHfB private key, the malware successfully obtains a valid Entra ID Primary Refresh Token (PRT).
4. Bypassing MFA & Password Resets: Because WHfB keys inherently satisfy multi-factor authentication claims (Satisfies MFA in Entra ID Conditional Access policies), the resulting PRT contains valid MFA claims. Furthermore, changing the user's password in Active Directory or Entra ID does not invalidate the underlying WHfB public key mapped to the user object in the directory, granting attackers persistent long-term access.
Industry Impact
As organizations rapidly adopt passwordless security architectures, threat actors are adapting by shifting focus from harvesting plaintext passwords to hijacking cryptographic authentication credentials:
* Erosion of Passwordless Security Assumptions: Security teams often assume passwordless biometrics immune to session theft, but malware running in the user's desktop session operates with the user's security context.
* Resilience Against Credential Remediation: Standard incident response playbooks relying on global password resets fail to evade this persistence mechanism unless WHfB keys are revoked directly from Entra ID / Active Directory objects.
* Lateral Movement in Hybrid Cloud Environments: Signed PRTs and Kerberos ticket requests enable seamless lateral movement across Microsoft 365, Azure resources, and on-premises Domain Controllers.
Recommendations & Mitigations
Enterprise security administrators should implement the following identity defense controls to mitigate WHfB key misuse:
Focus Area
Mitigation Control
Implementation Detail
Hardware Security
TPM Enforcement
Require hardware-backed TPM 2.0 chips for all WHfB key creation, enabling strict TPM key attestation and anti-hammering protections.
Access Control
Conditional Access
Mandate Microsoft Intune compliant device state and Microsoft Defender for Endpoint risk score evaluations before honoring PRT requests.
Incident Response
Key Revocation
Update protocols to include revoking WHfB credentials via Remove-MgUserAuthenticationFido2Method or clearing the msDS-KeyCredentialLink attribute.
Detection
API Monitoring
Enable EDR telemetry monitoring for anomalous processes making NCrypt calls targeted at WHfB key containers (NGC key storage paths).
________________
Report Validated By: Person
Review Date: Date