New Tool Exploits Windows 11 Recall Database Access

A security researcher has identified a method to access sensitive data from Windows 11's controversial Recall feature. The tool, dubbed "TotalRecall Reloaded," exploits a weakness not in the Recall database itself, which is deemed secure, but in how the system transfers data to another process, AIXHost.exe.

The method involves injecting a DLL file into AIXHost.exe, a process that lacks the robust security of the main Recall database. This injection can occur without administrative privileges. Once a user authenticates to Recall using Windows Hello, the TotalRecall Reloaded tool can intercept screenshots, text, and other metadata passed to AIXHost.exe, even after the user has closed the Recall application.

According to the researcher, some functions, such as capturing the latest screenshot or deleting the entire Recall database, do not require Windows Hello authentication. Microsoft has stated that this is not a vulnerability and does not plan to address it.