Researchers Detail TotalRecall Reloaded’s Windows Recall Data-Extraction Technique

Summary

Researchers say TotalRecall Reloaded can inject into Windows Recall’s less-protected AIXHost.exe as the current user, extracting decrypted screenshots and indexed data after Windows Hello authentication; Microsoft closed the report as “Not a Vulnerability.”

Key points

The research reports that AIXHost.exe handles decrypted Recall timeline data without PPL, AppContainer isolation, or strict code integrity checks.
TotalRecall Reloaded reportedly injects a DLL into AIXHost.exe using standard Windows APIs, without administrator privileges or a kernel exploit.
The tool does not bypass Windows Hello; it reportedly waits for authentication or prompts the user, then accesses decrypted data.
The payload reportedly extracts screenshots, OCR text and bounding boxes, metadata, named entities, and AI-generated activity descriptions.
The article reports that some Recall COM methods expose data or permit history deletion without authentication, while other interfaces enforce access restrictions.
The researchers say authentication state can persist for the Windows session and that modifying DiscardDataAccess can maintain access after Recall closes.
The report was submitted to Microsoft on March 6, 2026; Microsoft closed case 109586 on April 3 as “Not a Vulnerability,” saying the behavior matched the documented design.

Article Details

Attack Vectors: TotalRecall Reloaded injects a payload DLL into AIXHost.exe using standard Windows APIs, including VirtualAllocEx, WriteProcessMemory, and LoadLibraryW, at standard-user privilege.
The tool waits for Windows Hello authentication or prompts for it, then uses Recall's COM interfaces to extract decrypted screenshots, OCR text, metadata, and activity descriptions.
In stealth mode, TotalRecall Reloaded modifies DiscardDataAccess so that access is not revoked when Recall closes, allowing extraction to continue without another authentication prompt.
Some Recall COM methods reportedly allow pre-authentication access to screenshots or metadata, and alternate interface versions may permit access without the checks enforced by other versions.
Defensive Notes: The article identifies AIXHost.exe's lack of PPL enforcement, AppContainer isolation, and strict code integrity checks as a trust-boundary gap for decrypted Recall data.
The article reports inconsistent authorization across Recall COM interfaces, including some access before Windows Hello authentication.
Windows Hello authenticated state is reportedly cached for the Windows session in aihost.exe; restarting AIXHost.exe does not reset it.