Affected Systems

Windows Hello for Business on all Windows versions with Entra ID integration. Affects organizations using Windows Hello for Business as phishing-resistant authentication. TPM-backed and non-TPM deployments both vulnerable. No specific Windows build or deployment model identified.

Exploitation Status

Proof-of-concept published. PowerShell scripts (fido_assertion.ps1, hellopoc.ps1) available in ROADtools repository. No active exploitation or victims reported as of August 6, 2026. Technique presented at DEF CON 32 in 2024; current method removes prior device registration requirement.

Business Impact

Attackers with code execution in a signed-in Windows session can silently invoke Windows Hello for Business keys without triggering biometric prompts, extracting private keys, or requiring administrator privileges. This enables device registration under attacker control, Primary Refresh Token (PRT) acquisition valid for 90 days, and addition of persistent authentication methods. The attack bypasses phishing-resistant authentication and can satisfy Conditional Access policies requiring Microsoft authentication strength. Complete persistence depends on tenant device-state and compliance policies. No CVE assigned; Microsoft has not issued advisory or patch. Behavior is documented as design, not a vulnerability per se.

Urgency

🟡 Within a week

Recommended Actions

  • Monitor Entra ID sign-in logs for Windows Hello for Business authentications with empty or missing device ID claims; filter out known incognito browser sessions
  • Review and tighten device registration policies in Entra ID to require additional approval or restrict self-service device enrollment
  • Enforce Conditional Access policies requiring device compliance and device-state checks to interrupt PRT issuance on unmanaged devices
  • Deploy endpoint detection rules for unusual WebAuthn or Windows Hello for Business API calls from non-browser processes in user sessions
  • Audit recent device registrations and PRT issuance events for anomalies; revoke tokens and remove devices registered from unexpected sources