Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens

T2Covered by 1 source · first reported by The Hacker News at 27 Oct, 12:09 UTC

Microsoft has fixed a flaw in its Authenticator app for Android that let a malicious app with no permissions pose as a trusted Microsoft app, such as Teams, and collect sign-in tokens for a victim's work account. Microsoft tracks the flaw as CVE-2026-80097 and fixed it in Authenticator for Android…