Top Highlights
- A permissionless malicious Android app could exploit CVE-2026-80097 by posing as Teams to Microsoft Authenticator.
- The attack could steal work-account sign-in tokens, potentially exposing email, files, and calendars.
- Microsoft says exploitation requires a malicious app and user authentication; researchers reported token access without interaction, and no attacks are known.
Threat, Attack Techniques, and Targets
Microsoft fixed a flaw, CVE 2026 80097, in Authenticator for Android. A malicious app with no permissions could impersonate a trusted Microsoft app, such as Teams, and request a work account token.
The attacker’s app could start Authenticator’s AccountChooserActivity and supply the name of the app it claimed to be. Although Authenticator checked the genuine app’s signature, it did not verify which app had actually made the request.
Microsoft says an attack requires a malicious app on the device and a user to complete an authentication step. However, Enclave reported that its proof of concept needed no user interaction beyond a signed in account. Microsoft says attackers have not exploited the flaw.
Impact, Security Implications, and Remediation
In Enclave’s tests, tokens could grant access to work account email, files, and calendars. They could also allow users to send mail and change files or calendar entries. The tokens applied to the work account signed into Authenticator on that device.
Microsoft rated the flaw 8.6 on the CVSS scale and marked it Important. Therefore, organizations should update Microsoft Authenticator for Android to version 6.2606.4246 or later. Organizations that manage Android devices can require that minimum version through device management.
Microsoft’s advisory does not say whether an update cancels tokens that an attacker may already have obtained. Therefore, organizations should seek guidance from Microsoft on handling any potentially exposed tokens.
Continue Your Tech Journey
Learn how the Internet of Things (IoT) is transforming everyday life.
Explore past and present digital transformations on the Internet Archive.
ThreatIntel-V1
