Microsoft Authenticator Flaw on Android Let Rogue Apps Hijack Work Accounts
A vulnerability in Microsoft Authenticator for Android, tracked as CVE-2026-80097 and rated CVSS 8.6 by Microsoft, allowed any application installed on the same device to impersonate a legitimate Microsoft app and obtain authentication tokens for the victim's work account. On Android, Authenticator does more than display six-digit codes: it acts as a broker, issuing tokens to apps such as Teams and Outlook when they need to prove a user is signed in. Because the broker holds the keys to the entire Microsoft account, it is expected to verify which app is requesting a token. All Authenticator for Android versions before 6.2606.4246 are affected, and Microsoft published a fix on 8 September 2026 following coordinated disclosure.
The flaw stemmed from an exported component that any app on the device could open, with no special Android permissions and no user interaction required. When a calling app requested a token, Authenticator accepted the identity the caller claimed for itself rather than verifying the identity the operating system already knew. A validation step did exist, but it only confirmed that the details supplied in the request matched the genuine installed app — information any application on the device can read, and therefore trivially replayed. A test application built by the researchers used this to request tokens as Teams and, with a single corporate account signed in, read and send mail from the victim's mailbox, read and modify files, calendar entries and SharePoint sites, and post Teams messages as the user. By impersonating Authenticator itself, the test app could also alter the account's sign-in methods, including creating and deleting passkeys.
The practical consequence is a full work-account takeover that leaves no trace for the user: no consent prompt, no sign-in notification, and no visible sign that tokens were handed to an attacker. The ability to register an attacker-controlled passkey is the most damaging element, because it survives removal of the malicious app and gives persistent access to the tenant even after the device is cleaned. Exploitation still requires a malicious application to be present on the handset, so an attacker needs a sideloaded app, a trojanised store listing, or a user tricked into installing something unfamiliar — a realistic but not automatic precondition. Current exploitation status is low: FIRST EPSS places the probability of exploitation in the next 30 days at 0.5%, and there is no reporting of this flaw being used against real targets. The main residual exposure is fleet-wide, since corporate Android devices that have not received the Play Store update continue to run a broker that trusts whatever a calling app says about itself.
Attack Surface
Mobile Application, Mobile OS, Office 365
Tactics
Credential Access, Persistence, Collection, Defense Evasion
Techniques
- T1528 – Steal Application Access Token
- T1550.001 – Use Alternate Authentication Material: Application Access Token
- T1556.006 – Modify Authentication Process: Multi-Factor Authentication
- T1098.005 – Account Manipulation: Device Registration
SuperPRO's Threat Countermeasures Procedures
- Update Microsoft Authenticator for Android from the Google Play Store to version 6.2606.4246 or later, which contains Microsoft's fix for CVE-2026-80097; every build before that version is vulnerable.
- Enforce a minimum app version of 6.2606.4246 for Microsoft Authenticator through Intune or your MDM app-protection policy, and block or quarantine enrolled Android devices that report an earlier Authenticator build.
- Use MDM configuration to disable installation from unknown sources and sideloading on corporate Android devices, since CVE-2026-80097 can only be triggered by a malicious application already running on the handset.
- Review Microsoft Entra ID authentication-methods audit logs for passkey and FIDO2 credential registrations and deletions that were not initiated by the user, as the flaw allowed a rogue app to impersonate Authenticator and manage sign-in methods.
- Hunt Entra ID sign-in logs for token usage from the Teams and Outlook client IDs on Android devices where the corresponding app is not installed or not enrolled, and alert on Microsoft Graph mail, file and Teams message activity originating from those sessions.
- Revoke refresh tokens and force re-authentication for any account where unexplained passkey registration or anomalous Graph activity is found, then re-enrol the device after confirming Authenticator 6.2606.4246 or later is installed.
- Restrict app installation on managed Android devices to a curated Managed Google Play catalogue so unvetted applications cannot reach the device and invoke the Authenticator broker component.
