Microsoft Authenticator Flaw Let Rogue Apps Grab Work Tokens
Security researchers at Enclave have detailed a flaw in Microsoft Authenticator for Android, tracked as CVE-2026-80097. It let an app with zero permissions pose as an installed Microsoft app, such as Teams, and collect that app’s work-account tokens. Microsoft’s September 8 advisory lists the fix as Authenticator 6.2606.4246. The researchers have now published how the attack worked. If you use Authenticator for a work account, make sure you’re on that build or later. Enclave researcher Ofek Levin published the write-up, titled AuthMask, on October 23. He summarised the finding this way: According to Enclave, Authenticator exposed an exported activity that any app on the phone could launch. The calling app then supplied its own claimed identity. That included a package name, client ID, redirect URI and requested scopes. Authenticator checked that redirect URI against the signature of the…