Windows Hello Key Helps Malware Out

Entra ID researcher Dirk-jan Mollema demonstrated that malware already relaxing inside a signed-in Windows session can silently abuse Windows Hello for Business keys. Unfortunate Windows users now get to watch malware effortlessly authenticate itself straight into Entra ID for persistent access. If we wish to protect our Entra ID environments from signed-in session malware abusing these Windows Hello for Business keys, we must face another flaw in our supposedly secure login features.