Microsoft Authenticator Flaw Let Android Apps Steal Tokens
Microsoft patched a flaw in Authenticator for Android that let apps with no permissions pose as trusted apps like Teams and collect work account sign-in tokens.
Short answer: A flaw in Microsoft Authenticator for Android, tracked as CVE-2026-80097, let apps with no device permissions pose as trusted Microsoft apps and collect work account sign-in tokens. Microsoft fixed it in Authenticator version 6.2606.4246. Update the app now and check Microsoft's own advisory for any details not covered in initial reporting.
Microsoft fixed a flaw in Authenticator for Android that let apps with no device permissions pose as trusted Microsoft apps, such as Teams. Once disguised, the rogue app could collect sign-in tokens for a victim's work account. If you use Microsoft Authenticator on Android, update to version 6.2606.4246 now.
What Happened
Microsoft tracks this issue as CVE-2026-80097. According to The Hacker News, a malicious Android app with zero permissions could pose as a trusted Microsoft app like Teams.
By posing as a trusted app, the rogue app could collect sign-in tokens belonging to a victim's work account. Microsoft fixed the issue in Authenticator for Android version 6.2606.4246.
The published report does not spell out the exact technical mechanism behind the spoofing, and the passage describing the researchers' tests is incomplete in the source material we reviewed. We are not going to guess at the internals here. If you want the full technical breakdown, check the original Hacker News report and Microsoft's own security advisory for CVE-2026-80097, which should carry the complete write-up.
Why Token Theft Matters
Sign-in tokens let you stay signed in to work apps without retyping your password every time. Identity systems issue these tokens after you complete your first sign-in and MFA check.
If an attacker captures a valid token, they can often use it to access the same services you can, including email and chat. Multi-factor authentication does not help here, because the token already represents a session that passed MFA. That is why a flaw that leaks tokens is treated as serious, even without flashy technical detail.
Who Is Affected
Anyone running Microsoft Authenticator for Android on a version older than 6.2606.4246 was potentially exposed, if an untrusted app ran on the same device. The source reporting does not say whether personal Microsoft accounts are affected the same way as work accounts, so check Microsoft's own advisory if you need that scope confirmed.
Bring-your-own-device (BYOD) setups carry more risk in general. Employees often install personal apps next to work tools on the same phone, which widens the chance that one app can interfere with another.
Is It Being Exploited Right Now
The facts available to us say Microsoft fixed the flaw and recommends everyone update. The source material does not confirm whether attackers exploited this flaw in the wild before the patch, and the description of the researchers' tests is cut off in what we reviewed.
Given that gap, don't wait for proof of active exploitation. Update now. If Microsoft publishes exploitation details later, you will already be protected.
What To Do Right Now
1. Update Microsoft Authenticator
Open the Google Play Store on your Android device and update Microsoft Authenticator. Confirm you are on version 6.2606.4246 or later by checking the app's settings menu.
2. Review What's Installed on Your Phone
Uninstall apps you don't recognize or no longer use, especially ones from outside the Play Store. Fewer installed apps means a smaller attack surface for any flaw like this one.
3. Sign Out of Sessions if You Suspect a Problem
If you installed an app you no longer trust, sign out of your work account sessions from your Microsoft account security page. This invalidates old tokens, and you'll get fresh ones after you sign back in on the updated app.
4. For IT Teams: Enforce the Update
Use your mobile device management (MDM) tool to require Microsoft Authenticator 6.2606.4246 or later before devices can reach corporate resources. Block or flag devices that haven't updated.
What IT and Security Learners Can Take From This
This flaw is a reminder that identity and mobile security skills matter beyond just configuring passwords and MFA policies. Understanding how authentication tokens work, and how mobile platforms are supposed to isolate apps from each other, is core knowledge for anyone working in Cybersecurity.
If you're curious about how researchers find and test flaws like this one, our Penetration Testing & Ethical Hacking certification category is a good place to start exploring that skill set.
We don't have a certification in our catalog that maps directly to Android app sandboxing or Microsoft identity token internals, and we'd rather tell you that than force a mismatched product recommendation. Browse our Cybersecurity category page for identity- and access-related exam options as they become available.
At BuyExamVouchers.com, vouchers are delivered by email within 12 hours of purchase. Each voucher covers one exam attempt.
Final Checklist
Confirm every Android user on your team runs Authenticator version 6.2606.4246 or later.
Set MDM policy to block non-compliant app versions from accessing work data.
Ask staff to remove unused or unrecognized apps from devices with work profiles.
Watch for any follow-up advisory from Microsoft on exploitation status.
Check the original Hacker News report for updates, since parts of the researcher testing details weren't fully available at the time of this writing.
Sources
Questions about this topic
What is CVE-2026-80097?
CVE-2026-80097 is a flaw in Microsoft Authenticator for Android that let an app with no device permissions pose as a trusted Microsoft app, such as Teams. Once disguised, it could collect sign-in tokens for a victim's work account. Microsoft fixed it in Authenticator version 6.2606.4246.
Which Authenticator version fixes the flaw?
Microsoft fixed this issue in Authenticator for Android version 6.2606.4246. Check your app settings or the Google Play Store listing to confirm your installed version, and update if you're on an older build.
How exactly did the malicious app steal tokens?
Public reporting confirms the rogue app could pose as a trusted Microsoft app without needing special permissions, but it does not lay out the full technical mechanism. For the complete technical detail, check Microsoft's own security advisory for CVE-2026-80097.
Is this flaw being actively exploited?
The available source material does not confirm active exploitation in the wild before the patch. It also doesn't fully describe the researchers' test results, so don't assume either way — update your app regardless of exploitation status.
Are personal Microsoft accounts affected too?
The reporting we reviewed focuses on work account tokens and doesn't clearly state whether personal accounts are affected the same way. Check Microsoft's advisory for CVE-2026-80097 if you need that confirmed.
What should IT admins do first?
Push the Authenticator update to version 6.2606.4246 or later across all managed Android devices through your MDM tool. Block devices running older versions from accessing corporate resources until they update.