SURIQ
Phishing-resistant sign-in was supposed to be the finish line for identity security. Buy hardware-bound keys, switch on Windows Hello for Business, and there is no password to phish and no secret to steal off the wire. Work shown at Black Hat USA 2026 undercuts that promise from an angle few teams put in their threat model.
Dirk-jan Mollema, a researcher who focuses on Entra ID, demonstrated that an implant sitting inside a user's live Windows logon can drive that person's Windows Hello key to sign that user straight into Microsoft Entra ID, the cloud identity behind Microsoft 365 and Azure sign-in. From that single foothold the attacker walks off with a token good for 90 days. The key material stays put on the machine the whole time, and nobody sees a prompt.
How the key gets borrowed without a prompt
The Windows Hello for Business private key lives in the machine's secure chip and is never meant to leave it. That guarantee is intact. What Mollema pulled on is the state Windows holds while you are logged in. Your PIN entry is cached as a ticket, so any code in your session can reach the key through the operating system's native cryptography calls and produce a signature. No PIN screen, no fingerprint, no elevation. Whatever the malware wants signed, it gets signed.
What it asks the key to sign is a passkey login challenge for Entra ID. The flaw Mollema found is that Entra does not tie that challenge to the machine, the account, or the tenant it was issued for. So the attacker pulls a challenge on a box they own, ships it to the compromised host for the Hello key to sign, and hands the finished assertion back to Entra inside a five-minute window. Then the detail that matters: the token that comes back has no device identifier on it. That absence is the pivot. A token with no device claim is permitted to enroll a fresh device, and any enrolled device may request a Primary Refresh Token, the long-lived credential that carries single sign-on across Microsoft 365 and Azure. It lasts 90 days and renews with use. The attacker then registers their own passkey on the device they hold, and the access sustains itself.
Mollema published a proof of concept in his ROADtools toolkit, extending Hello key work he first presented at DEF CON 32 in 2024. There is no CVE and no Microsoft advisory as of August 6, 2026. He frames the result not as a bug but as fallout from the way Hello for Business is designed, and says it was left untouched.
| The assumption teams bought | What the research shows |
|---|---|
| The private key never leaves the secure chip, so it is safe | True, and it does not matter; the endpoint signs on the attacker's behalf |
| A PIN or biometric gates every use of the key | While the user is logged in, a cached PIN entry signs with no prompt |
| Phishing-resistant sign-in stops account takeover | Signed-in malware forges a valid Entra login without phishing anyone |
| The credential is bound to one device | The returned token carries no device ID, so the attacker enrolls their own |
Why phishing-resistant login did not save the account
This is the latest in a short run of techniques we have tracked that beat a phishing-resistant or multi-factor control by operating from inside an already-authenticated session, or through a retired login path, rather than by stealing a secret. We wrote up device-code phishing that seizes Microsoft 365 with no password, malware that can log in with a victim's Chrome passkey with two-factor still on, and a case where multi-factor failed to block an Azure CLI password spray. The shape keeps repeating.
Once an attacker holds code execution inside your logged-in session, the property you paid for goes quiet. A key that cannot be exported is still a key the endpoint will operate for whoever controls the process. Hardware binding answers theft of the credential; it says nothing about use of the credential while the real user is signed in. When most shops rolled out Hello for Business, the picture in their head was a stolen or phished key, not a live implant riding the session. That is the gap the research walks through.
Each figure above drives a triage decision. A single instant of code execution converts into three months of access. The signing step asks for no PIN and no admin rights, so it slips past the events teams usually alert on. And with Microsoft treating it as intended behavior, there is no fix in the pipeline to wait for.
The hunt, and why the obvious query is noisy
The forensic marker Mollema points to is a Hello for Business login whose device ID field comes back blank. Alert on that field by itself, though, and you drown. An ordinary private-browsing window, or a browser that skips single sign-on, records the same empty value, so the standalone rule fires on staff doing nothing wrong.
The signal lives in the sequence, not the lone record. A blank-device-ID Hello login trailed within minutes by a first-time device enrollment and an initial Primary Refresh Token, more so from an address the user has never touched, is the fingerprint of this chain. A key that has ridden one laptop for a year does not usually herald a new device joining the tenant moments later. Stitching the sign-in record to device-enrollment and audit events separates a noisy rule from a useful one, and that cross-signal threat hunting is what surfaces post-authentication abuse the login itself reads as clean.
Make the device the gate, not just the key
With no patch on the way, device state is the control that snaps the chain. Demand a compliant or hybrid-joined device in Conditional Access for anything that matters, so a newly enrolled attacker device is refused even after the assertion is forged. Tighten who is allowed to register or join devices in your Entra device settings, and raise an alert on enrollments that do not line up with a known onboarding. Keep an eye on new passkey or Hello key registration against existing accounts, since that is how the intruder turns a session into a tenant.
None of this erases the underlying behavior. Each step strips out the move that turns a five-minute forged login into 90 days of quiet residence. Phishing-resistant credentials were never the finish line. On a domain-joined fleet, the device is.