Malware Can Abuse Windows Hello for Business Keys for Persistent Entra ID Access

A security researcher has revealed a new attack class called NatJack, which exploits network address translation connection state. This attack can hijack active TCP sessions, spoof DNS responses, and disclose victim IP addresses and mapped ports. Additionally, it can exhaust NAT tables, allowing for further malicious activity. The researcher demonstrated these techniques across various network infrastructure devices at Black Hat USA 2026. The attack class poses a significant threat to network security.