Dirk-jan Mollema demonstrated that malware running on a signed-in Windows session can silently use a victim’s Windows Hello for Business key to authenticate to Microsoft Entra ID. This allows attackers to establish persistent cloud access, register controlled devices, obtain Primary Refresh Tokens (PRTs), and add further authentication methods, bypassing tenant policies.