Critical Microsoft Authenticator flaw let malicious Android apps steal access to your precious accounts

Date:
Tue, 27 Oct 2026 15:20:00 +0000

Description:
Authenticator was granting session tokens left and right, but the bug has now been fixed.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter A critical Microsoft Authenticator flaw let rogue Android apps steal Microsoft session tokens without user interaction Attackers could impersonate trusted Microsoft apps and access emails, Teams data, calendars, and files Microsoft patched the bug and urges Android users to update Authenticator immediately A critical vulnerability in the Microsoft Authenticator app for Android allowed
malicious apps to obtain session tokens for pretty much any Microsoft app and hand them over to the attackers.

Unlike other Android malware, this one did not require extensive permissions, the victims did not need to approve the login process, and the attackers did not need to know their victims login credentials. Found by researchers at Enclave , the vulnerability, now tracked as CVE_2026-80097, is fixed and Microsoft is urging all users to update their Authenticator app as soon as possible. Latest Videos From TechRadar Watch full video here: What is Authenticator and how was it abused? Authenticator is Microsofts two-factor authentication (2FA) app . Besides users, it also allows other apps to authenticate, giving them session tokens that grant them access to the users Microsoft work account and associated data. In practice, it means that a legitimate app such as Microsoft Teams can log into a users work account through Authenticator.

Enclave's security researchers set out to test how secure this process was.
In an experiment, which they detailed on this link, they used an Android device that was logged into a Microsoft service and had the Authenticator app installed. Nothing less - nothing more. You may like Microsoft login pages
are being abused as hackers try and lure in unlucky victims Sanctioned billion-dollar cybersecurity company from Russia finds 11 vulnerabilities in Google and Apple products including a nasty one that compromised a device just through a malicious NFC tag Microsoft Exchange flaw allows hackers to read mailboxes across an organization, so patch now

Then, they installed a third app that was not malicious by any usual Android standards - it did not ask for extensive permissions, it did not contact a shady third-party server, and it did not try to exfiltrate any data.

What it did do, however, was pretend to be a legitimate Microsoft Teams app. As such, it asked Authenticator to, well, authenticate it, and grant it
access to the data. Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners
or sponsors By submitting your information you agree to the Terms &
Conditions and Privacy Policy and are aged 16 or over.

To do that, it provided the necessary data: proper package name, client ID, and redirect URI. Authenticator confirmed the data was real and granted the app the token. Voila - the researchers were given access to emails, Teams
chat messages, calendars, and were also allowed to modify and send messages, alter files, calendar entries, send chat messages, and even manage certain authentication methods (create or delete passkeys). A controlled experiment How, you might ask? Apparently, Authenticator was just checking if the data the app provided was real - not the nature of the app providing the data itself. In other words, any app could have said Hey, Im Teams, give me a session token, and would receive it.

The worst part is that this was all being done in the background. The researchers did not have to confirm the apps login attempt, nor were they notified of it to begin with. What to read next This fake LastPass Authenticator app will just shut off your antivirus and leave you open to attack Experts reveal Google Password Manager can be hijacked to let hackers steal passkeys and gain access to all your secrets Microsoft Cloud accounts stolen in highly complex impersonation and passkey phishing campaign

We found that an unprivileged Android app with zero permissions could impersonate any installed Microsoft first-party app and have the Microsoft Authenticator broker hand it that app's tokens, they said. This is a big
deal, since asking for extensive permissions is the number one way to spot malicious Android apps.

Luckily for everyone involved, Enclave did not spot this attack in the wild and instead created it in a controlled environment. There is no evidence anyone tried anything similar in the wild, but now that the news is out, chances are they'll try. Therefore, it is vital all Authenticator users
update their apps as soon as possible.

The silver lining in this report is that the malicious app still needs to
land on the target Android device somehow. These apps likely wont make it
into the Google Play Store, and as long as users refrain from downloading shady .APK files from unvetted app stores, they should be fine.

Enclave reported the vulnerability to the Microsoft Security Response Center, which confirmed the issue and released a fix. It said that Microsoft Authenticator for Android versions earlier than 6.2606.4246 are affected and stressed that users should update to version 6.2606.4246 or later through the Google Play Store. The best antivirus for all budgets Our top picks, based on real-world testing and comparisons

Read our full guide to the best antivirus 1. Best overall: Bitdefender Total Security 2. Best for families: Norton 360 with LifeLock 3. Best for mobile: McAfee Mobile Security Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.



======================================================================
Link to news story: https://www.techradar.com/pro/security/critical-microsoft-authenticator-flaw-l et-malicious-android-apps-steal-access-to-your-precious-accounts


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)