▶️ Watch on YouTube: https://youtu.be/XhPqUKZz6kk
🌐 Website: https://tekthrill.com
📺 Subscribe: https://youtube.com/@tekthrill
A flaw in Microsoft Authenticator for Android let a malicious app with zero permissions pose as Microsoft Teams and collect sign-in tokens for a work account, researchers say. It is fixed. Here is what happened, who is affected, and a step-by-step check you can do on your phone.
What was reported:
- Enclave published the research ("AuthMask", by Ofek Levin of its fellowship program) on Oct 23, 2026. Help Net Security, TechRadar and The Hacker News reported it on Oct 27, 2026.
- Microsoft tracks it as CVE-2026-80097. According to Enclave and Help Net Security, Microsoft published it on Sept 8, 2026, rated it 8.6 on the CVSS scale and fixed it in Authenticator for Android version 6.2606.4246. Earlier Android versions are affected.
- Enclave says one part of Authenticator could be opened by any app and trusted what the calling app said about itself, so an app could claim to be Teams and get Teams' token. A signature check only confirmed details any app can read.
- In Enclave's tests, tokens could read and send email, read and change files, calendars and SharePoint sites, send Teams messages as the victim and, posing as Authenticator itself, create and delete passkeys.
- Enclave says no user interaction was needed beyond a signed-in account. Microsoft's advisory, as reported by The Hacker News, says an attack needs a malicious app on the device plus the user completing a sign-in step in Authenticator. Microsoft says the flaw was not exploited in attacks and rates exploitation as less likely.
- The Hacker News notes the advisory does not say whether updating cancels a token a bad app may already have taken.
Chapters:
0:00 Intro
0:21 What researchers found
1:11 How the trick worked
1:59 What a fake app could do
2:29 What Microsoft says
2:57 Who is affected
3:10 Step 1: Update and check the version
3:35 Step 2: Check sign-ins, methods and devices
4:30 Token-theft habits
5:07 Wrap-up
What to do: update Authenticator from the Google Play Store and check you are on 6.2606.4246 or later; review recent sign-ins (Authenticator or mysignins.microsoft.com), your Security info methods and your Devices list (myaccount.microsoft.com); tell your IT or security team if anything looks off. Admins: enforce the minimum version through device management.
Have you checked your Authenticator version yet? Tell us in the comments.
Try free AI tools 👉 https://tekthrill.com
Subscribe to TEKTHRILL for tech news you can actually use.
Sources:
Enclave: https://enclave.ai/blog/authmask-we-made-microsoft-authenticator-hand-over-tokens
Help Net Security: https://www.helpnetsecurity.com/2026/10/27/microsoft-authenticator-vulnerability-patchedcve-2026-80097/
The Hacker News: https://thehackernews.com/2026/10/microsoft-authenticator-flaw-let.html
