Executive Summary
- •Researcher Dirk-jan Mollema demonstrated that malware can abuse the Windows ticketing process to register an attacker-controlled device and obtain a 90-day Primary Refresh Token.
- •The attack operates on TPM-backed systems without extracting the private key, recovering the PIN, triggering a biometric prompt, or needing administrator privileges.
- •By treating the Windows Hello key as a FIDO2 passkey via WebAuthn, an attacker satisfies Conditional Access policies requiring phishing-resistant authentication.
Community Sentiment
Key Developments & Data
Malware inside a signed-in Windows session abuses Windows Hello for Business keys to silently authenticate to Microsoft $MSFT Entra ID.
Researcher Dirk-jan Mollema demonstrated that malware can abuse the Windows ticketing process to register an attacker-controlled device and obtain a 90-day Primary Refresh Token.
The attack operates on TPM-backed systems without extracting the private key, recovering the PIN, triggering a biometric prompt, or needing administrator privileges.
By treating the Windows Hello key as a FIDO2 passkey via WebAuthn, an attacker satisfies Conditional Access policies requiring phishing-resistant authentication.
The disclosure reports no active victims, and as of August 6, 2026, there is no CVE or Microsoft advisory tied to the technique that administrators need to watch out for.
Zubiqo Intelligence Briefing
Get the unfiltered signal before markets open.
Top tech breakthroughs, venture funding, and market moves—synthesized into a 2-minute morning read. Zero PR fluff.
✓ 100% Free•✓ 1-click unsubscribe•✓ No spam ever
Zubiqo Strategic Assessment
Primary Impact
Enterprise identity and access management teams relying exclusively on Windows Hello for Business and Microsoft Entra ID Conditional Access policies for phishing-resistant MFA.
Strategic Shift
The transition of attack paths from traditional credential theft to local session hijacking, as threat actors exploit active endpoints to bypass hardware-backed identity controls.
The Ripple Effect
Organizations will deploy strict endpoint detection rules hunting for empty device IDs during Windows Hello sign-ins to catch silent FIDO2 passkey abuse.
This intelligence assessment is generated by Zubiqo's AI for informational purposes only.
