Microsoft Authenticator Flaw Let Fake Android Apps Steal Work Account Tokens. Update Now

If you sign in to Outlook, Teams or any other work or school Microsoft account on an Android phone, open the Play Store and check one app today: Microsoft Authenticator.

Security firm Enclave has published the details of a flaw it calls “AuthMask,” which let a malicious Android app with zero permissions trick Authenticator into handing over sign-in tokens for your work account. Microsoft tracks it as CVE-2026-80097, rates it 8.6 out of 10 on the CVSS scale and classifies it as “Important.” The fix is already out. Version 6.2606.4246 closes the hole, and anything older is vulnerable.

The good news is that Microsoft says there is no evidence anyone used this in real attacks. The bad news is how simple the trick was.

How the AuthMask flaw worked

On Android, Microsoft Authenticator does more than generate six-digit codes. For work and school accounts it acts as a “broker”: when Teams or Outlook needs to sign you in, it asks Authenticator, and Authenticator hands back a token that proves who you are. That is what makes single sign-on across Microsoft’s apps feel seamless.

The problem, according to Enclave researcher Ofek Levin, was that Authenticator trusted the caller’s own description of itself. A rogue app could open a part of Authenticator that any app on the phone is allowed to start, announce that it was Microsoft Teams, and get Teams’ token back. Authenticator did check an app signature, but it checked the signature of the app being impersonated. Since the real Teams was installed, that check passed.

The Hacker News summed it up in one line:

“The app said it was Teams, and the broker believed it.”

Authenticator could actually see which app was really making the request. It just did not use that information when deciding whether to issue the token.

What an attacker could reach

In Enclave’s tests, the fake app got Microsoft Graph tokens that let it read and send email, read and write files, open calendars and SharePoint sites, and send Teams messages as the victim. Help Net Security reports that, by posing as Authenticator itself, the test app could also change sign-in methods, including adding or deleting passkeys. That is the scariest part: an attacker who planted their own passkey could keep access to the account even after the malicious app was deleted.

The reach was limited to the work or school account signed in to Authenticator on that phone. Personal Microsoft accounts were not part of the reported impact, and no iOS version was named in the disclosure.

Microsoft and Enclave don’t fully agree on how easy it was

There is one real disagreement worth knowing about. Enclave says its proof of concept pulled tokens with no user interaction beyond having an account signed in. Microsoft’s advisory says an attacker would need to get a malicious app onto the device and get the user to complete an authentication flow in Authenticator, and its CVSS score reflects that user interaction is required. Microsoft rates exploitation as “less likely.” Either way, both sides agree the first step is installing a bad app, which is why where you get your apps matters.

The timeline

That seven-week gap between the patch and the public write-up is standard responsible disclosure. Microsoft publicly thanked Enclave for letting it fix the bug first. It also means anyone whose phone auto-updates apps has almost certainly been protected since September.

How to make sure you’re protected

This takes about a minute:

1. Open the Google Play Store and search for Microsoft Authenticator.
2. Tap Update if the button appears. If it only says Open, you are on the current version.
3. Confirm the version number. Go to Settings, then Apps, then Authenticator, and look for the version at the bottom of the App info screen. It should read 6.2606.4246 or higher.
4. Turn on auto-updates for the app from its Play Store page (three-dot menu, then Enable auto update) so the next fix arrives without you thinking about it.
5. Review your sign-in methods. If you ever installed apps from unknown sources on your work phone, check your account’s security info page for passkeys or methods you don’t recognize, and tell your IT department.

If your phone is managed by your employer, IT can enforce the minimum version through mobile device management, and many already do. Neither Microsoft nor the researchers have said whether updating revokes tokens a malicious app may already have collected, which is another reason to report anything that looks off rather than assume the update cleaned it up.

The bigger lesson for Android users

AuthMask is a reminder that “no permissions” does not mean “harmless.” Android’s permission prompts cover things like your camera, location and contacts. They don’t cover what other apps will willingly hand over when asked, and this bug lived entirely in that gap.

The practical defense has not changed: stick to the Play Store, keep Google Play Protect on, avoid sideloading on any phone that holds your work account, and let your security apps update themselves. Microsoft patched this one quickly and quietly. Making sure your phone actually has that patch is the only part left to you.

Sources: The Hacker News, Help Net Security, Thurrott, RuntimeWire. Photo by Onur Binay on Unsplash.