analiza aiqbench
This article details a critical vulnerability where malware can exploit cached cryptographic keys in Windows Hello for Business to authenticate directly to Microsoft Entra ID, bypassing standard biometric or PIN requirements. The research highlights how attackers can leverage existing session processes and WebAuthn protocols to generate valid Primary Refresh Tokens without needing physical access to the Trusted Platform Module (TPM) or victim interaction. This represents a significant shift in threat vectors for enterprise identity management systems relying on passwordless authentication mechanisms.
Malware Abuses Windows Hello for Business Key to Authenticate Microsoft Entra ID
A newly demonstrated technique shows how malware in a compromised Windows user session can abuse Windows Hello for Business (WHFB) cryptographic keys to authenticate to Microsoft Entra ID, enabling attackers to gain cloud access without the victim’s password, PIN, or biometric data. Windows Hello for Business is designed as a passwordless authentication system. It normally […] The post Malware Abuses Windows Hello for Business Key to Authenticate Microsoft Entra ID appeared first on Cyber Security News.
A newly demonstrated technique shows how malware in a compromised Windows user session can abuse Windows Hello for Business (WHFB) cryptographic keys to authenticate to Microsoft Entra ID, enabling attackers to gain cloud access without the victim’s password, PIN, or biometric data. Windows Hello for Business is designed as a passwordless authentication system. It normally stores a…
Extras afișat conform termenilor RSS ai publicației · 57 cuvinte · textul integral și figurile sunt pe site-ul publicației
Subiecte conexe
Weekly Cyber Security Newsletter Bulletin – Entra ID RCE, Claude Code Ransomware, T-Mobile Cable, Azure Credential Theft +20 Stories
Cybersecurity News · 23 aug. 2026
TrustSink Attack Uses Rogue MFA Provider to Steal Microsoft Entra Passwords During Legitimate Logins
Cybersecurity News · 28 sept. 2026
Weekly Cybersecurity Newsletter Bulletin – Cisco and Android 0-Day, BragJack Attack, Claude Opus 5 Used to Hack OpenAI, and 20+ Stories
Cybersecurity News · 21 sept. 2026
Hackers Hide Malware Commands in Outlook Events Dated 2050 and Use as C2 Channel
Cybersecurity News · 21 iul. 2026