Entra ID researcher Dirkjan Mollema demonstrated that malware already running in a signedin Windows session can silently use the victim's Windows Hello for Business key to authenticate to Microsoft Entra ID. The attacker can then establish longerterm cloud access, register a device it controls, obtain a Primary Refresh Token PRT, and add further authentication methods where tenant policies.📖 Read more.
🔗 Via "The Hacker News"
----------
👁️ Seen on @cibsecurity