Malware Exploits Windows Hello for Business Keys for Persistent Entra ID Access

Introduction

In today’s zero‑trust landscape, the line between identity protection and network security is increasingly blurred. A presentation at Black Hat USA 2026 by security researcher Malcolm Stagg sheds light on a troubling convergence: malware that can abuse Windows Hello for Business (WHFB) keys to secure long‑term access within Entra ID, paired with a novel attack class called NatJack that exploits network address translation (NAT) states to hijack live TCP sessions, spoof DNS replies, and reveal target IP addresses and port mappings. Together, these techniques illustrate how an attacker can maintain a foothold across both identity and network layers, creating a persistent threat that is difficult to detect and eradicate.

The disclosure underscores the need for organizations to treat identity keys and network devices as interdependent components of a security stack. While WHFB was designed to provide strong, hardware‑backed authentication, the research demonstrates that when those keys fall into malicious hands, they can be weaponized to bypass modern access controls. Simultaneously, the NatJack methodology reveals how traditional network‑level protections can be subverted, emphasizing the importance of holistic monitoring and defense strategies.

Abusing Windows Hello for Business Keys for Persistent Entra ID Access

Windows Hello for Business is built on a combination of certificate‑based authentication and hardware‑protected keys stored on trusted platforms. These keys are meant to be uniquely tied to a user’s device, reducing reliance on passwords and mitigating credential‑theft attacks. However, the research shows that once an attacker obtains a WHFB key—through techniques such as device compromise, extraction from memory, or exploitation of key‑management flaws—they can impersonate the legitimate user across Microsoft’s cloud identity services.

• Key Extraction: Attackers can leverage kernel‑level exploits or forensic tools to pull private keys from secure enclaves, especially on misconfigured or outdated systems.
• Replay Attacks: Stolen keys enable attackers to craft valid authentication tokens that are accepted by Entra ID, bypassing multi‑factor safeguards.
• Privilege Escalation: With a valid WHFB token, malicious actors can request higher‑privilege cloud apps, often without triggering typical anomaly alerts.

Because these keys are stored in a format that is trusted by the cloud identity provider, the malicious activity can appear as legitimate traffic, making detection challenging. The persistence stems from the fact that compromised keys can be reused across multiple sign‑in events, effectively providing a long‑term backdoor into the organization’s cloud environment.

NatJack: Manipulating NAT for Session Hijacking and Information Disclosure

While identity‑based attacks focus on credentials, NatJack targets the underlying network infrastructure. The technique leverages the way NAT devices maintain connection state tables to perform several malicious actions:

• TCP Session Hijacking: By predicting or injecting forged packets that match an existing NAT mapping, an attacker can take over an active TCP session without the original client’s involvement.
• DNS Response Spoofing: NatJack can inject falsified DNS answers into the NAT’s translation process, redirecting users to malicious hosts while appearing legitimate to the end‑system.
• IP and Port Disclosure: The attack exposes internal IP addresses and port numbers that are normally hidden behind NAT, providing attackers with a clearer view of the target network topology.
• NAT Table Exhaustion: By generating a flood of half‑open connections, the attacker can overflow the NAT’s state table, causing legitimate traffic to be dropped and opening a window for further exploitation.

Stagg’s proof‑of‑concept demonstrations spanned a range of network appliances, including enterprise routers, firewalls, and load balancers, highlighting that the vulnerability is not limited to a single vendor or device class. The research also revealed that many NAT implementations do not adequately validate the integrity of connection state updates, making them susceptible to injection attacks.

Conclusion

The research presented by Malcolm Stagg serves as a stark reminder that modern security threats often span multiple layers of an organization’s IT stack. Malware that exploits Windows Hello for Business keys provides a durable pathway into cloud identities, while NatJack demonstrates how network infrastructure can be weaponized to hijack sessions, spoof DNS, and expose hidden assets. To mitigate these risks, enterprises should adopt a unified security strategy that combines robust key management, continuous device attestation, and advanced network traffic analysis. Grivyonx Cloud’s suite of AI automation and cybersecurity services is designed to help organizations detect, respond to, and prevent such multi‑vector attacks, ensuring that identity and network defenses work in concert to protect critical assets. By staying vigilant and leveraging integrated threat intelligence, businesses can stay one step ahead of adversaries seeking to abuse the very tools meant to protect them.