AI
The PRT Cookie on Windows and macOS
The Primary Refresh Token (PRT) represents the user identity. On Windows, it stays inside the TPM. The system calculates a PRT cookie with a 50-minute lifetime. That cookie exchanges for refresh tokens and session tokens. On macOS, Microsoft’s implementation uses an SSO extension inside the Company Portal app. The same browser core that handles requests on Windows also appears on macOS. The key difference: there is no LSASS. The SSO extension computes the final PRT cookie.
Method One: Headless Browser
The Microsoft SSO Chrome extension can be installed on a headless browser. An attacker who compromises a macOS device can launch an invisible browser, install the extension, and request a PRT cookie immediately. Logs confirm the browser core handles the request. The limitation: the victim must be logged into the desktop session. This technique only works with Chrome and Microsoft Edge.
Method Two: Bypassing the Browser Core Parent Process Check
Reverse engineering the browser core revealed a parent process check. It calls runningApplicationWithProcessIdentifier to get the parent’s team ID and bundle ID, then hashes them against an internal allowlist. The trick: the codesign utility is called without an absolute path. An attacker can place a fake codesign in /tmp and use path hijacking. The malicious binary is packaged as an .app so the API recognizes it as a proper process. This method runs at user privilege with no dependencies.
Method Three: Direct SSO Invocation via Apple’s API
The SSO extension exposes four paths. Two of them – general SSO extension request and cookie acquisition – do not check the team ID at all. Only the bundle ID is verified. The allowlist contains 39 bundle IDs covering Edge, third-party browsers, and non‑native browsers. An attacker can pick any of them and call the API directly. This method also runs at user privilege without dependencies. It was used in the demo that followed.
Persistence Through Device Forgery
A stolen PRT cookie expires in roughly 15 minutes. To persist, the team abused device registration. They stole a PRT cookie with a cached MFA claim, then called the password reset API – which the front end restricts but the back end does not – to set a new password without knowing the old one. With a fresh password and MFA claim, they registered a fake device, added a new MFA method (a passkey or TOTP key), and finally created a Windows Hello for Business key. That key bypassed MFA requirements. Microsoft initially said the MFA bypass was “not a vulnerability.” After seeing the DEF CON slide, they committed to requiring fresh MFA.
Microsoft Response and Mitigations
Microsoft fixed the macOS PRT cookie theft. The Windows side remains exploitable. One week before DEF CON, Microsoft decided to fix the persistence method. Recommendations: update macOS Company Portal, monitor codesign calls from /usr/bin and headless browser activity, and enforce conditional access policies that check IP, location, and user agent. Even after Microsoft’s patch, Intune policies that allow certain bundle IDs may still expose the PRT cookie.
Notable Quotes
the NGC MFA protection is a good idea. However, um it’s actual implement um is flawed just like this French fries in the door. Tung-Lin “Echo Lee” Lee · ▶ 29:06
we determine this is not a um a vulnerability and claim that MFA bypass is a hyper hole. We agrees with them since we have to um cont have a PRT cookie with a cache MFA status. Tung-Lin “Echo Lee” Lee · ▶ 29:31
if you cannot update yet, you can just monitor following criteria like a co sign. You should be always running on the user bin folder and the monitor the header browser. If there is a binary has a bundle ID we mentioned today but there is a B binary don’t have the enough validate signature just trigger alert Shang-De “HackerPeanutJohn” Jiang · ▶ 39:19
Key Takeaways
- PRT cookies on macOS can be stolen via headless browser, parent process bypass, or direct API call.
- The NGC MFA protection is circumvented by adding a new MFA method using a stolen PRT cookie.
- Microsoft fixed macOS cookie theft but delayed fixing the persistence chain until one week before DEF CON.
About the Speaker(s)
Shang-De Jiang is a deputy director of the research team of CyCraft. He focuses on Incident Response, Endpoint Security, and Microsoft Security, and has presented at TROOPERS, HITB, HITCON, CodeBlue, Blue Team Summit, and BlackHat USA. He is co‑founder of UCCU Hacker.
Dong-Yi “Kazma Ye” Ye is a university student and cybersecurity intern at CyCraft. His work examines Entra ID on macOS, binary internals, and authentication logic. He plays CTF with team B33F 50UP and is passionate about reverse engineering and exploitation.
Tung-Lin “Echo Lee” Lee is a cybersecurity researcher at CyCraft specializing in network and cloud security. He has presented at DEVCORECONF, HITCON ENT, ROOTCON, InfoSec Taiwan, and CyberSec.