Malware Can Abuse Windows Hello for Business Keys for Persistent Entra ID Access

Security researcher Malcolm Stagg disclosed a new attack class called NatJack at Black Hat USA 2026. The technique manipulates network address translation (NAT) connection state to hijack active TCP sessions, spoof DNS responses, disclose victim IP addresses and mapped ports, and exhaust NAT tables. Demonstrations were conducted across network infrastructure devices, highlighting significant risks to network security.