A flaw in Microsoft's Authenticator app for Android let a fake app grab work account tokens without asking. Microsoft has fixed it, but only updated phones are safe.
Microsoft has fixed a serious flaw in Authenticator for Android that let a malicious app pose as a Microsoft app and collect work account access tokens. The app needed no special permissions and no approval from the user. The bug is tracked as CVE-2026-80097 and scored 8.6 out of 10 for severity.
Authenticator acts as a go-between that hands out tokens. A token is a digital pass that proves you are signed in, so you do not have to enter your password each time. Researchers at Enclave found that a rogue app on the same phone could claim to be a trusted app, such as Microsoft Teams, and ask Authenticator for tokens in that app's name.
Authenticator checked whether the claimed identity looked valid. It did not confirm that the app asking was really that app. Because the real Teams app was installed, the fake request could pass the check. Authenticator then handed back the tokens.
Depending on which Microsoft app was imitated, the tokens could open Microsoft Graph, the service behind Microsoft 365 data. The researchers showed that a fake Teams identity could read and write mail, send messages, access files and change calendars. Mailboxes, OneDrive, SharePoint and Teams services could all be within reach.
The risk applied to Android phones with Microsoft Authenticator installed and a work account signed in. Companies that use Microsoft 365 on Android are the most exposed. The attacker needed a malicious app already installed on the phone, so this was not an attack that worked from afar.
Anyone who does not use Authenticator with a work account on Android was not in the situation described. Anyone running version 6.2606.4246 or newer has the fix.
Microsoft released the fix in July 2026. The steps in the alert box above cover the update and the cleanup for individuals and IT teams.
The material does not say whether anyone used this flaw in real attacks. Microsoft's official advisory for CVE-2026-80097 is the place to look for ongoing guidance. Security teams are advised to keep watching for unusual Microsoft Graph activity, unexpected consent prompts and token use from unfamiliar Android devices.
If you use Microsoft 365 for work on Android, update Authenticator to version 6.2606.4246 or newer through Google Play.
A holiday fraud warning says fake stores and bait messages are spreading during sales, and a quick check before you click can protect your money and card details.
Read more: Check These Things Before You Click on a Holiday DealA leak shows how Apple may tighten Full Disk Access on Macs, the setting that lets an app read nearly everything, as AI agent apps ask for it more often.
Read more: Apple plans to make it harder for AI apps to see all your Mac filesA Georgia sheriff says scammers are calling families and demanding cash to free a jailed relative. Real jails do not work that way, and the call is built to rush you.
Read more: Sheriff warns of phone scam demanding money to free jailed relatives
