Technology Miraj Islam October 27, 2026 0 Comments

Critical Microsoft Authenticator flaw allows malicious Android apps to steal access to your precious accounts

Add us as a preferred source on Google

Subscribe to our newsletter

A critical Microsoft Authenticator flaw allowed fraudulent Android apps to steal Microsoft session tokens without user interaction
Attackers could impersonate trusted Microsoft applications and access emails, Teams data, calendars, and files.
Microsoft fixed the bug and urges Android users to update Authenticator immediately

A critical vulnerability in the Microsoft Authenticator app for Android allowed malicious apps to obtain session tokens for virtually any Microsoft app and deliver them to attackers.

Unlike other Android malware, this one did not require extensive permissions, victims did not need to approve the login process, and attackers did not need to know their victims’ login credentials.

The vulnerability, found by Enclave researchers, now tracked as CVE_2026-80097, is fixed and Microsoft urges all users to update their Authenticator app as soon as possible.

What is Authenticator and how has it been abused?

Authenticator is Microsoft’s two-factor authentication (2FA) app. In addition to users, it also allows other applications to authenticate, giving them session tokens that grant them access to the users’ Microsoft work account and associated data. In practice, it means that a legitimate app like Microsoft Teams can log into a user’s work account through Authenticator.

Enclave security researchers set out to test how secure this process was. In an experiment, which they detailed in this link, they used an Android device that was logged into a Microsoft service and had the Authenticator app installed. Nothing less, nothing more.

Then, they installed a third app that wasn’t malicious by typical Android standards: it didn’t ask for extensive permissions, it didn’t contact a suspicious external server, and it didn’t try to exfiltrate any data.

What it did do, however, was pretend to be a legitimate Microsoft Teams app. As such, you asked Authenticator to authenticate you and grant you access to the data.

To do this, you provided the necessary data: appropriate package name, client ID, and redirect URI. The authenticator confirmed that the data was real and granted the token to the application. Voila: researchers had access to emails, Teams chat messages, calendars and were also allowed to modify and send messages, alter files, calendar entries, send chat messages and even manage certain authentication methods (create or delete passkeys).

A controlled experiment

How?, you ask. Apparently, Authenticator was only checking whether the data the app was providing was real, not the nature of the app providing the data itself. In other words, any app could have said “Hey, it’s Teams, give me a session token” and would receive it.

The worst thing is that all this was done in the background. The researchers did not have to confirm the app’s login attempt, nor were they notified about it to begin with.

“We found that an unprivileged and permissionless Android app could impersonate any installed Microsoft first-party app and have the Microsoft Authenticator agent deliver tokens for that app,” they said. This is a big problem, since requesting extensive permissions is the number one way to detect malicious Android apps.

Fortunately for everyone involved, Enclave did not detect this attack in the wild and instead created it in a controlled environment. There’s no evidence that anyone has tried anything similar in the wild, but now that the news is out, it’s likely they’ll try. Therefore, it is vital that all Authenticator users update their apps as soon as possible.

The positive side of this report is that the malicious app still needs to somehow land on the target Android device. These apps likely won’t make it to the Google Play Store, and as long as users refrain from downloading suspicious .APK files from unauthorized app stores, everything should be fine.

Enclave reported the vulnerability to the Microsoft Security Response Center, which confirmed the issue and published a fix. It said that versions of Microsoft Authenticator for Android earlier than 6.2606.4246 are affected and emphasized that users should update to version 6.2606.4246 or later through the Google Play Store.