The Repeat · New episode every Monday
Last week's attacks. This week's protection.
Every Monday, The Repeat breaks down what attackers actually did last week to Microsoft environments and the services you rely on: what happened, why the usual defenses stayed quiet, and the exact steps to take before the same attack repeats on you. A few focused minutes, no jargon.
Latest episode
Windows Hello for Business: malware can sign in as you
Episode 44 min
Windows Hello for Business is how many organizations satisfy Microsoft's own advice to require phishing-resistant MFA on admin accounts. Research published on 5 August 2026 shows that malware already running inside a signed-in Windows session can use the Hello key to authenticate as that user, with no PIN prompt, no biometric prompt, and no administrator rights. Windows keeps the signing key available to the session, so code running as the user can have it sign a WebAuthn assertion that Entra accepts, that meets the phishing-resistant strength tier, and that counts as fresh MFA. Because no device took part in the sign-in, the token carries no device ID claim, which lets the attacker register a device of their own and collect a Primary Refresh Token for it.
What to do about it today
- Run the sign-in log query below across every tenant you manage.
- In Conditional Access, target the Register or join devices user action and grant only with Require authentication strength. That stops a new device being registered without a fresh MFA prompt.
- Review Entra ID > Devices > All devices for registrations you don't recognize. Remove the device object and revoke the user's sessions: revoking sessions is what actually ends the access, removing the device alone does not.
- Don't turn Windows Hello off over this. There is no CVE and no patch because the behavior works as designed, no exploitation has been reported, and it needs code execution in an already signed-in session. FIDO2 hardware keys are not affected the same way, since each use requires a physical touch.
SigninLogs
| where AuthenticationDetails has '"authenticationMethod":"Windows Hello for Business"'
| where DeviceDetail.deviceId == ""A Windows Hello sign-in with an empty device ID is not something that should happen in normal operation. Query credit: Dirk-jan Mollema, who published the technique.
The format
What happened. Why it worked. What to do.
Most people hear about an attack weeks after it mattered, when it's a headline instead of a warning. The Repeat closes that gap: one short episode, every Monday, built from what actually hit the week before.
What happened
Last week's campaign in plain language: who was targeted, how it got in, and the real numbers behind it.
Why defenses missed it
The specific reason alerts stayed quiet, so you can check whether yours would have too.
What to do now
Concrete steps and, when it helps, the exact query to run. Usable in minutes, without buying anything.
Archive
Past episodes
Every week the archive grows by one attack you no longer have to learn about the hard way.
Beyond awareness
Watching is how you find out. Members are already protected.
The Repeat exists because most organizations learn about an attack after it lands, when the cleanup starts. Awareness closes part of that gap. It cannot close all of it, because attackers move faster than headlines.
That is the problem UnifiedONE was built for. When one member of the community validates a threat, protection applies to everyone connected, at the front gate, before impact. The attack you hear about on Monday is often one the community stopped the week before.
About the series
When do new episodes come out?
Every Monday. Each episode analyzes attacks from the previous week, so the steps are current when you watch.
What does The Repeat cover?
Real campaigns from the previous week that affect Microsoft environments and the everyday services organizations rely on. Each episode explains what happened, why defenses missed it, and what to do about it.
Is it only about Microsoft?
Microsoft environments come up often because that's where most organizations live, but the series covers whatever mattered last week, whichever service it hit.
Do I need UnifiedONE to use the advice?
No. Every step works on its own, with the tools you already have. UnifiedONE automates the same protection across a community, so members are covered before an episode even airs.
Never learn about an attack too late again.
Subscribe for Monday's episode, or connect your environment and let validated protection apply automatically.