A critical vulnerability in Microsoft Authenticator allows apps to steal account tokens, granting access to emails, files, and calendars without passwords.
Researcher reveals Android vulnerability
Ofek Levin, a researcher at the cybersecurity company Enclave, published details of a vulnerability on October 23, which he named AuthMask. He demonstrated that an Android application without any permissions could impersonate Microsoft Teams and obtain account tokens from Microsoft Authenticator connected to a professional account.Tokens grant access to sensitive data
These tokens serve as digital passes, allowing access to email, OneDrive, SharePoint files, or the calendar without a password or two-factor authentication. Authenticator has more than 100 million downloads on the Play Store, making it a widely used security tool.Microsoft addresses the issue
Microsoft published its security advisory on September 8, 2026, under the reference CVE-2026-80097. All Android versions prior to 6.2606.4246 are affected. However, this corrected version was available as early as July 2026, before the advisory was published.Vulnerability became public after delay
The operation of the vulnerability became public only a month and a half later. Authenticator believed applications on their word, relying on the assumption that only legitimate apps would request tokens.How the attack works
On Android, Authenticator acts as an intermediary: when Teams or Outlook wants to connect, it asks it for a token. However, part of Authenticator could be launched by any application on the phone. It only checked that the request matched the real Teams installed, whose information is readable by everyone, without checking who actually sent the request.Attack requires no user action
By impersonating Authenticator itself, the test application from Enclave was even able to create and delete access keys (the famous passkeys), which would allow maintaining control over the account after the removal of the malicious application. The attack required installing a malicious application on a phone where a professional account was connected to Authenticator. Then, the theft occurred without any action from the user.Steps to secure your device
What you need to check on your phone: Update Microsoft Authenticator from the Play Store, then check that the installed version is at least 6.2606.4246. If you manage company phones, enforce this minimum version in your fleet management tool. For the rest, the basic settings to secure a smartphone apply. Be wary of applications installed outside of official stores, and even on the Play Store: fake versions of WhatsApp and Chrome have already managed to sneak in.
