“You’ll lose your malware, too,” Marta replied. “FSLogix will roam your profile. Your apps will be in the image. But the ghost? The ghost dies every night.”
The CISO, a veteran of the firewall era, looked confused. “But our Cloud PCs are secured. We have anti-malware. We have network security groups.” securing cloud pcs and azure virtual desktop
The CISO read the log. “What’s the lesson for the board?” “You’ll lose your malware, too,” Marta replied
Marta stared at the alert dashboard. It was 11:47 PM. The office was empty, but the Azure Virtual Desktop host pool was not. But the ghost
The attacker lasted seven minutes. Then they vanished.
The forensics team traced the ghost sessions back to a compromised managed identity. Someone had phished a helpdesk admin, stole a service principal’s secret, and used it to register a malicious device to the company’s Entra ID.
The CISO went pale. “So they can just… reassign a computer to themselves?”