A rogue Android app could take over work accounts through Microsoft Authenticator. Check the version on every phone

On Android, Microsoft Authenticator does more than show codes. It hands sign-in tokens to Teams, Outlook and other Microsoft apps. Researchers at Enclave found it would hand them to any app on the phone that claimed to be one of those apps, with no permissions and no tap from the user.

Microsoft fixed it in September. The details went public last week, so now is the time to make sure no phone in your fleet is still on an old build.

A rogue Android app with zero permissions could ask Microsoft Authenticator for Teams’ tokens and get them, plus enough access to add its own passkey to a work account.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

Authenticator handed tokens to any app that claimed to be Teams

Enclave researcher Ofek Levin found that Authenticator’s AccountChooserActivity was exported, so any app could launch it. The request carried the caller’s claimed package name, user ID and redirect URI, and Authenticator checked only that the redirect URI matched the claimed app’s signature, a value any app can read from the phone. It never compared the claim with the app actually calling.

Posing as Teams, the test app got Microsoft Graph tokens with Mail.ReadWrite, Mail.Send, Files.ReadWrite.All, Calendars.ReadWrite and Sites.ReadWrite.All. Posing as Authenticator itself, it got UserAuthenticationMethod.ReadWrite, Passkey.Create and Passkey.Delete. Microsoft published CVE-2026-80097 on September 8, and Enclave published its write-up, which it calls AuthMask, on October 23.

Work accounts on Android phones with an older Authenticator

The attacker still needs a malicious app on the phone, which usually means a user was talked into installing one. After that, the token theft is silent. With the passkey scopes, Help Net Security notes, an attacker can add a passkey of their own and keep signing in after the rogue app is removed.

Any organization that uses Authenticator as the broker on Android is in scope: one work account signed in is enough. Help Net Security reports Microsoft rated the flaw 8.6 on the CVSS scale.

Confirm every Android phone runs 6.2606.4246 or later

• Use your device management tool’s app inventory to find Android devices with Microsoft Authenticator below 6.2606.4246, and push the update from managed Google Play.
• Where your tools support it, require that minimum version before the device can reach company email and files.
• Tell staff who use personal Android phones for work to update Authenticator from Google Play and check the version under the app’s settings.
• Keep blocking sideloaded apps on managed work profiles, since the attack needs an app on the device.

Details

• CVE: CVE-2026-80097, Microsoft Authenticator elevation of privilege (improper authentication), published September 8, 2026. Fixed in Microsoft Authenticator for Android 6.2606.4246; earlier versions are affected.
• Entry point: exported activity com.microsoft.identity.client.AccountChooserActivity in the :auth process; tokens returned in a plaintext broker_result_v2_compressed bundle (Enclave).
• Scopes Enclave obtained: Microsoft Graph mail, files, calendar, Teams chat and SharePoint access; api.spaces.skype.com user_impersonation; authentication method and passkey management.

Hunt / verify

• In Entra ID audit logs, review recent security info registrations, especially new passkeys, for users who sign in on Android, and confirm each one with the user.
• Look at sign-in logs for Microsoft Graph or Exchange access from Android devices at odd hours, and for refresh-token use from devices the user does not recognize.
• Neither Enclave nor Help Net Security reports any use of the flaw in attacks so far.

Source: Enclave: AuthMask write-up

Sources

• Enclave: AuthMask, We Made Microsoft Authenticator Hand Over Tokens to an App With Zero Permissions
• Help Net Security: Microsoft Authenticator vulnerability let rogue Android apps steal work account access

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].