Your phone’s guard was letting thieves in through the front door — and it never even asked for a password.
That is what researchers found inside Microsoft Authenticator for Android. The app that protects your sign-ins had a flaw that handed your work account to any app that asked nicely. It is fixed now. Here is the short version — and the one thing you need to do.
What happened
On 23 October 2026, security researchers at Enclave revealed a flaw they called “AuthMask”.
Authenticator for Android exposed a part of itself that any app on the phone could open — even an app with zero permissions.
A fake app could pretend to be Teams, ask for Teams’ tokens, and walk away with them. The flaw, CVE-2026-80097, scored 8.6 out of 10. Microsoft fixed it in version 6.2606.4246.
How it worked
Authenticator works as a broker: sign in once, and it hands tokens to Teams, Outlook and OneDrive so they do not ask again.
A token is proof you already signed in. Whoever holds it acts as you — no password, no second check.
The broker trusted whatever identity the asking app claimed, instead of checking who was really calling. Copying the real Teams app’s details was enough.
What attackers could take
The stolen tokens opened the whole work account: emails, files, calendar, SharePoint, and Teams messages sent as the victim.
Worst of all, by pretending to be Authenticator itself, an attacker could add their own passkey — a back door that stays even after the fake app is deleted.
Who was at risk
Only Android users with a work account in Authenticator — and only if a malicious app was already on the phone. The theft itself was silent, but it needed that first bad install, usually through sideloading or a fake app.
What to do right now
- Update Authenticator from the Play Store — version 6.2606.4246 or later. Updated after July 2026? You are already safe.
- Company phones: enforce that minimum version on every Android device.
- Never sideload apps. If an app arrives via a link or a file, do not install it.
- If an unknown app was ever on your phone, check your account’s sign-in methods and remove passkeys or devices you do not recognise.
The bigger lesson
Small businesses now run on the same tools as big companies — and inherit the same risks, without a big IT team watching.
Tokens are the new passwords: stolen quietly, reused silently, past your second factor. One update was the whole fix here — but only for those who actually update.
Quick questions
Am I affected? Android + work account + older than 6.2606.4246. Update, and you are safe.
iPhones? No — this was Android-only.
Is it fixed? Yes, before the researchers went public. Updating is all most people need.
Sources
This article is based on reporting from: Enclave — AuthMask: We Made Microsoft Authenticator Hand Over Tokens, Help Net Security — Microsoft Authenticator vulnerability patched (CVE-2026-80097), GBHackers — Microsoft Authenticator flaw allows Android apps to steal tokens, AndroidPure — Microsoft Authenticator flaw let rogue apps grab work tokens, Cyber Security News — Microsoft Authenticator flaw lets malicious apps steal tokens, and PBXScience — Microsoft Authenticator for Android flaw.
Worried about your business’s security?
One outdated app was enough to expose entire work accounts. A security check of your website, email and devices can catch the gaps before attackers do. Get a free website and security audit, no obligation.
Email us at [email protected] and tell us what your business needs.
