Malware Can Abuse Windows Hello for Business Keys for Persistent Entra ID Access
- ID
- 11881
- Status
- summarized
- Published
- 07 Aug 2026, 4:52 PM
- Fetched
- 07 Aug 2026, 7:47 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/malware-can-abuse-windows-hello-for.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 6.0
- Created
- 07 Aug 2026, 7:49 PM
- Tags
- Audience
- developerssaas_founders
What happened
Security researcher Malcolm Stagg disclosed a new attack class called NatJack at Black Hat USA 2026, which manipulates NAT connection state to hijack TCP sessions, spoof DNS responses, disclose victim IPs/ports, and exhaust NAT tables. Two CVEs were assigned: CVE-2026-56181 (CVSS 8.3) in Windows NAT used by Hyper-V, and CVE-2026-63913 (CVSS 8.2) in Linux Netfilter conntrack. The attack requires the attacker to be behind the same NAT as the victim, and there is no single patch for the broader class—mitigations include separating untrusted workloads, applying platform updates, encrypting internal traffic, and enabling IP Source Guard.
Why it matters
If you run multi-tenant cloud, container, or VM environments where untrusted workloads share NAT infrastructure with trusted systems (common in Hyper-V or Linux-based hosting), you should segment those workloads now and apply the available Windows and Linux patches. Encrypting traffic even on internal networks is now a concrete recommendation, not a nice-to-have.
Discussion angle
For Malaysian SaaS founders running on shared cloud or VPS infrastructure: do you know whether your provider isolates NAT state between tenants, and have you checked if your internal service-to-service traffic is encrypted?