Critical Microsoft Authenticator flaw let malicious Android apps steal access to your precious accounts

• A critical Microsoft Authenticator flaw let rogue Android apps steal Microsoft session tokens without user interaction
• Attackers could impersonate trusted Microsoft apps and access emails, Teams data, calendars, and files
• Microsoft patched the bug and urges Android users to update Authenticator immediately

A critical vulnerability in the Microsoft Authenticator app for Android allowed malicious apps to obtain session tokens for pretty much any Microsoft app and hand them over to the attackers.

Unlike other Android malware, this one did not require extensive permissions, the victims did not need to approve the login process, and the attackers did not need to know their victim’s login credentials.

Found by researchers at Enclave, the vulnerability, now tracked as CVE_2026-80097, is fixed and Microsoft is urging all users to update their Authenticator app as soon as possible.

What is Authenticator and how was it abused?

Authenticator is Microsoft’s two-factor authentication (2FA) app....

Copyright of this story solely belongs to www.techradar.com. To see the full text click HERE