Microsoft Authenticator Bug Let Rogue Apps Steal Work Logins

Open Microsoft Authenticator on an Android phone and it looks like any other app — a screen with six-digit codes and "approve sign-in" buttons. For months, though, any other app on that same phone could have quietly borrowed its trust. No special access requested, no suspicious permission prompt to raise a flag. Just install, wait, and collect.

The bug, in plain terms

Security researcher Ofek Levin at Enclave found the flaw and published the technical write-up, nicknamed "AuthMask," on October 23. It's tracked as CVE-2026-80097 (CVE is the public catalogue number every disclosed software flaw gets, so researchers, vendors and governments can all refer to the same bug), and Microsoft rates it 8.6 out of 10 on the CVSS severity scale — "Important," one notch below its top rating.

The problem sat inside how Authenticator hands out access tokens — the temporary digital passes an app uses to prove "yes, this user is already signed in" without asking for a password every time. A component inside the app, meant to let trusted Microsoft software like Teams or Outlook request those tokens, was left reachable from outside that trusted circle. A malicious app — one that declared zero Android permissions at install time, so nothing about it would look suspicious — could impersonate Teams, ask Authenticator for a token, and get handed one meant for someone's real work account.

In testing, that stolen token was enough to reach the victim's work email, files and calendar — the same reach a legitimate sign-in would get. Microsoft fixed the underlying authentication check in Authenticator version 6.2606.4246; anything from 6.0.0 up to that build was exposed. The company's advisory, first published September 8 and revised a week later, lists the flaw as not observed being exploited and rates future exploitation "less likely" — but a working proof of concept is now public, which tends to shorten that runway.

A security app you trust completely is still just another app on a phone full of apps you've never heard of.

Why a zero-permission app is the scary part

Android's whole pitch to users is that permissions are the safety net — an app that can't touch your camera, contacts or files can't do much harm. This bug didn't need any of that. It exploited a trust relationship between two apps made by the same company, which is a blind spot permission prompts were never designed to cover. That's also what makes it hard to catch after the fact: there's no unusual permission grant in your settings to go back and check.

• Affected: Microsoft Authenticator for Android, versions 6.0.0 up to (not including) 6.2606.4246
• Fixed in: version 6.2606.4246 and later
• What was exposed: work-account sign-in tokens, giving access to email, files and calendar
• Exploitation status: no confirmed in-the-wild attacks reported so far, but the technique is now public

Why this matters more in India than the headlines suggest

Most global coverage of this bug has treated it as a routine patch-and-move-on story. That undersells it for an Indian audience. India has the largest Android user base of any country, and a large share of its white-collar workforce — IT services staff, startup employees, government contractors — logs into Microsoft 365 for work every day, often from a personal phone carrying Authenticator alongside dozens of apps downloaded from the Play Store with little vetting. A flaw that needs zero permissions to work is tailor-made for exactly that kind of device: one phone doing double duty as a personal gadget and a corporate access key. Indian IT and ITES firms that lean on Microsoft 365 for client work — and that are increasingly expected to report security incidents to CERT-In under its reporting rules — have real reason to treat this as more than background noise, not less. If you've read our explainer on how two-factor authentication actually works, this is a reminder that the app enforcing that second factor has to be trustworthy too — 2FA isn't a single unbreakable lock, it's a chain, and this was a weak link in it.

What to actually do about it

The fix itself is simple: update Microsoft Authenticator on Android through the Play Store if you haven't already — most phones will have pulled the patched version automatically by now, but it's worth checking the version number manually if your IT team hasn't confirmed it. Organizations running their own mobile device management should also push the update as a checked, not assumed, step, and review sign-in logs for the weeks the flaw was live for anything that looks like an unfamiliar device suddenly gaining access to a mailbox.

The deeper lesson outlasts this one patch. Security researchers keep finding that the weakest point in modern authentication isn't the password or even the second factor — it's the trust apps quietly extend to each other behind the scenes, where neither users nor permission systems are watching. Expect more bugs shaped exactly like this one, because the incentive to look for them just went up.