Microsoft Patches Critical Android Flaw That Let Rogue Apps Posing as Teams Steal Sign-In Tokens

Microsoft has addressed a security vulnerability in its widely used Authenticator application for Android devices, resolving a flaw that could have allowed an unprivileged malicious application to masquerade as trusted corporate utilities, such as Microsoft Teams, and harvest authentication tokens for enterprise work accounts.

Tracked officially by Microsoft as CVE-2026-80097, the security defect was successfully remediated in Authenticator for Android version 6.2606.4246. Security researchers and enterprise IT administrators strongly advise all users and organizations relying on the mobile application to update to the latest patched version immediately to maintain account integrity.

According to technical findings established during rigorous testing by security analysts, the compromise of a victim’s work account through this vector could grant bad actors sweeping, unhindered access to sensitive organizational resources. Specifically, the illicitly acquired authentication tokens yielded full access permissions to the targeted user’s corporate email correspondence, cloud-stored files, and comprehensive calendar schedules.

Despite the high severity of potential impacts, Microsoft has noted that exploiting this particular vulnerability successfully would also require the victim to complete a standard sign-in interaction step within the Authenticator app itself. Furthermore, the technology giant confirmed that, to date, this specific flaw has not been observed in the wild or actively leveraged in real-world malicious campaigns.

The discovery of the vulnerability is credited to researcher Ofek Levin, who participated through a specialized fellowship program at Enclave, a prominent cybersecurity firm. Enclave publicly released comprehensive technical details regarding the exploit mechanism on October 23, 2026. Prior to public disclosure, the vulnerability was responsibly reported and assigned a CVE by Microsoft on September 8, 2026. Microsoft evaluated the security issue utilizing the Common Vulnerability Scoring System, assigning it an 8.6 rating and classifying its severity level as "Important."

To understand the mechanics of the flaw, it is necessary to examine the expanded role that the Microsoft Authenticator application plays within modern mobile environments. On the Android operating system, Authenticator functions as much more than a simple generator of temporary six-digit multi-factor authentication passcodes. Instead, it operates heavily as a central broker for identity and access management.

When enterprise productivity applications—such as Microsoft Teams, Outlook, or other integrated services—require user authentication, they do not handle the credential exchange directly. Instead, these client applications delegate the request to the Authenticator broker app. In turn, Authenticator validates the user context and issues a cryptographic token, which acts as a secure digital pass proving that the user has successfully authenticated. Because this central broker manages authorization across an entire enterprise account ecosystem, it must strictly regulate which client applications receive valid tokens.

The vulnerability identified by researchers exposed a breakdown in this validation pipeline. Specifically, the Authenticator application exposed a specific component known as an activity, designated as AccountChooserActivity, which could be freely initiated by any third-party application installed on the mobile device. When an attacker’s malicious application launched this specific component, the Authenticator app automatically constructed its outgoing token request using parameters explicitly provided by the untrusted caller app. This included the declared identity of the requesting application itself. Consequently, if the malicious app declared that it was Microsoft Teams, the broker application accepted that claim at face value.

Ideally, internal security controls within the broker should have prevented this unauthorized token issuance via rigorous cryptographic verification. A signature check was ostensibly implemented for this very purpose. The security mechanism was designed to look up the official, legitimate cryptographic signature of the application being impersonated and confirm that the incoming request correlated with it. However, the implementation was flawed. Because legitimate applications like Microsoft Teams were genuinely installed on the target device alongside the malicious app, the real signature was accessible on the system for validation. As a result, the signature check successfully matched the real application’s credentials and mistakenly approved the transaction.

Further investigation by Enclave revealed that while the Authenticator application possessed the technical capability to inspect which specific application had genuinely initiated the incoming request, it failed to utilize that data effectively when deciding whether to release a sensitive token.

During controlled testing scenarios conducted by the research team, an unprivileged application posing as Microsoft Teams requested tokens from Microsoft Graph. The resulting output successfully returned broad scopes of permissions, including capabilities to read and transmit email messages, read and modify cloud-hosted files, and access extensive calendar data.

Microsoft outlined the general security impact, noting that a successful attacker who managed to exploit the workflow could effectively authenticate as the legitimate, signed-in user and access all associated cloud resources. The organization clarified that these resultant tokens apply explicitly to the specific work account signed into the Authenticator application on that individual hardware device, rather than extending across disparate accounts or personal profiles.

A notable discrepancy emerged between the technical findings published by Enclave and the advisory guidance issued by Microsoft regarding the necessity of user interaction during an exploit attempt. Enclave reported that their proof-of-concept testing was capable of returning valid tokens without explicit user interaction beyond the baseline presence of an already signed-in account on the device. Conversely, Microsoft’s official security advisory states that successful exploitation inherently requires an attacker to successfully install a malicious application on the local hardware and subsequently convince the human user to complete a routine authentication flow within the Authenticator interface. This assessment aligns with the user interaction requirement factored into the assigned CVSS score.

Microsoft has emphasized that the flaw was addressed proactively and had not been exploited prior to the patch rollout. The remediation was integrated into the company’s broader security updates released during September 2026 Patch Tuesday. The vulnerability was distinct from the high-profile Windows flaws highlighted that month as actively targeted zero-day vulnerabilities, and as of late October 2026, it remains absent from the U.S. Cybersecurity and Infrastructure Security Agency Known Exploited Vulnerabilities catalog.

For remediation, enterprise customers and individual consumers must update the Microsoft Authenticator application for Android to version 6.2606.4246 or any subsequent release. Enterprise environments utilizing mobile device management solutions can enforce compliance by mandating this minimum application version across corporate device fleets. Available documentation leaves open questions regarding whether updating the application automatically revokes previously issued tokens acquired by malicious third-party apps prior to the patch application, leaving system administrators to monitor endpoint security closely as the advisory details continue to be reviewed across the security community.