Malware Can Abuse Windows Hello for Business Keys for Persistent Entra ID Access
Windows Hello keys can be abused from signed-in Windows sessions to gain Entra ID access without extracting TPM-backed private keys.
More info