A critical Microsoft Authenticator flaw let rogue Android apps steal Microsoft session tokens without user interaction
Attackers could impersonate trusted Microsoft apps and access emails, Teams data, calendars, and files
Microsoft patched the bug and urges Android users to update Authenticator immediately
A critical vulnerability in the Microsoft Authenticator app for Android allowed malicious apps to obtain session tokens for pretty much any Microsoft app and hand them over to the attackers. Unlike other Android malware, this one did not require extensive permissions, the victims did not need to approve the login process, and the attackers did not need to know their victim’s login credentials. Found by researchers at Enclave , the vulnerability, now tracked as CVE_2026-80097, is fixed and Microsoft is urging all users to update their Authenticator app as soon as possible. What is Authenticator and how was it abused? Authenticator is Microsoft’s two-factor authentication (2FA) app . Besides users, it also allows other apps to authenticate, giving them session tokens that grant them access to the users’ Microsoft work account and associated data. In practice, it means that a legitimate app such as Microsoft Teams can log into a user’s work account through Authenticator. Enclave’s security researchers set out to test how secure this process was. In an experiment, which they detailed on this link, they used an Android device that was logged into a Microsoft service and had the Authenticator app installed. Nothing less – nothing more. Then, they installed a third app that was not malicious by any usual Android standards – it did not ask for extensive permissions, it did not contact a shady third-party server, and it did not try to exfiltrate any data. What it did do, however, was pretend to be a legitimate Microsoft Teams app. As such, it asked Authenticator to, well, authenticate it, and grant it access to the data. To do that, it provided the necessary data: proper package name, client ID, and redirect URI…