Microsoft has fixed a high-severity flaw in Authenticator for Android that let a malicious app on the same phone obtain tokens for a signed-in work account without a password, a prompt or any declared permission. Researchers have now published how the chain works.

What happened

The bug is CVE-2026-80097, rated 8.6 and classified by Microsoft as a local elevation of privilege caused by improper authentication. The weak point was an exported Android activity, com.microsoft.identity.client.AccountChooserActivity.

Enclave researchers showed that an untrusted app could present itself as a trusted Microsoft client such as Teams, and ask Authenticator to issue delegated tokens for that identity. The request needed no user approval and no credentials beyond being installed on the device. Returned data could include access tokens, refresh tokens and ID tokens, and with a Teams identity requesting Graph permissions the reach extended to mail, files, calendar and SharePoint content.

Microsoft fixed the issue in Authenticator for Android version 6.2606.4246, affecting builds from 6.0.0 onward. The vendor's position is that exploitation also requires the victim to complete a sign-in step in Authenticator, and that the flaw has not been used in attacks.

Who is affected

• Any Android phone or tablet with Microsoft Authenticator installed and a work account signed in, below version 6.2606.4246
• Organisations that treat Authenticator as the second factor for Microsoft 365, which describes most South African SMEs running Microsoft mail
• Users who install APKs from outside the Play Store, where a hostile app is easiest to plant

What to do now

Push Authenticator for Android to 6.2606.4246 or later through your MDM, and check for devices that bypass the store.

• Pull an app inventory from Intune or your MDM and list Authenticator versions below 6.2606.4246
• Force the update, then confirm the version on a sample of handsets rather than trusting the compliance report alone
• Block sideloaded applications, or at minimum alert on them, for any device holding a work identity
• Review Microsoft Graph sign-in and consent logs for token use from unfamiliar Android devices

What this means for South African businesses

The interesting part is not the patch, it is the target: the app that everyone trusts because it is the second factor turned out to be a token dispenser for anything else on the phone. In practice the risk of an SME being hit today is low, since Microsoft reports no exploitation and the attack needs malware already installed. What should worry a local IT manager is the pattern of assuming the authenticator app sits outside the patching programme; phones are the least-inventoried estate in most small businesses, and this is a concrete reason to start treating them as managed endpoints.

Source: Cyber Security News - Microsoft Authenticator token theft

Also on the blog

• Rand Mutual investigates claimed 366GB claims data theft, 5 November leak deadline
• Fake IT support on Teams: 400+ incidents, payload running in under 15 minutes

Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.