What happened (quick and slightly alarming)

Microsoft patched a security bug in its Android Authenticator app (CVE-2026-80097) that could let a sneaky app on your phone pose as a trusted Microsoft app and grab tokens for a work account. In non-tech terms: a misbehaving app could pretend to be Teams/Outlook, ask Authenticator for the digital keys that prove you’re signed in, and walk away with them.

The fix shipped in Authenticator for Android version 6.2606.4246, so the short, blunt advice: steal work tokens is what the bug enabled — update the app.

How it worked, why it mattered, and what to do

Authenticator does more than serve six-digit codes — it acts as a middleman that hands out tokens when other Microsoft apps need to sign someone in. One of its components, an activity named AccountChooserActivity, could be started by any app on the device. The attacker’s app simply told Authenticator, “I’m Teams,” and Authenticator trusted the claim when building the token request.

There was a signature check, but it went about things backwards: it validated the signature of the app being impersonated by reading the installed app’s signature (like Teams), which of course was present, so the check passed. Authenticator could tell which app actually made the call, but it didn’t use that information when deciding whether to hand over a token.

Researchers testing the proof-of-concept said the stolen tokens gave broad access — email, files, calendars — essentially letting an attacker act as the signed-in user for that work account on that device. The researchers and Microsoft disagree on whether the exploit needs user interaction; the researchers’ test reportedly succeeded with minimal interaction, while Microsoft says the attacker would also need the user to complete an authentication step in Authenticator. Microsoft also says there’s no evidence the flaw was used in the wild and rated the bug as important (CVSS 8.6).

  • Immediate steps: update Authenticator to version 6.2606.4246 or later.
  • If you manage devices: require the minimum version via your device management or MDM policy.
  • If you’re worried about a possible compromise: rotate credentials, consider revoking tokens/sessions from your account admin portal, and review sign-in activity.

One remaining wrinkle: Microsoft’s advisory doesn’t say whether installing the patched app invalidates any tokens an attacker may already have grabbed. That detail wasn’t made clear, so if you suspect compromise treat it seriously — revoke sessions and reset access where possible.

Bottom line: this was a clever impersonation due to a brokerage bug. Patch, check your admin controls, and keep an eye on sign-in logs — not because your phone suddenly hates you, but because sometimes software gets a little too trusting.