Goodbye? Attackers Can Bypass 'Windows Hello' Strong Authentication

Accenture researcher Yehuda Smirnov disclosed a downgrade vulnerability in Windows Hello for Business where an adversary-in-the-middle can intercept and modify POST requests (e.g., to "/common/GetCredentialType") or user-agent/isFidoSupported parameters to force a fallback from phishing-resistant authentication (TPM-backed biometric/PIN) to phishable methods; the technique was automated with Evilginx and a phishlet. Microsoft mitigated the issue by adding an "authentication strength" Conditional Access capability allowing administrators to require strictly phishing-resistant methods.