1 November 2026
Microsoft Authenticator on Android Could Hand Work Tokens to a Rogue App: Check Versions Now
A now-patched flaw in Microsoft Authenticator for Android (CVE-2026-80097) let a malicious app pose as Teams and collect a user's Microsoft 365 tokens. A public proof of concept landed on 23 October. Here is what NZ organisations should check this week.
What happened
Microsoft Authenticator on Android does more than approve sign-ins. It also acts as the sign-in broker for other Microsoft apps on the phone, such as Teams and Outlook.
Researchers at Enclave found that, in versions before 6.2606.4246, Authenticator would accept a sign-in request from any app on the device that claimed to be a trusted Microsoft app. It checked the claim against details the calling app supplied itself, so a malicious app with no special Android permissions could pose as Teams and receive that user's Microsoft 365 access and refresh tokens. In Enclave's testing, those tokens gave delegated access to mail, files and calendar through Microsoft Graph.
Microsoft fixed the issue and published it as CVE-2026-80097 on 8 September 2026 (CVSS 8.6, rated Important). Microsoft says it has not seen exploitation and that the user must take a step in Authenticator. Enclave says its proof of concept needed no interaction beyond having a work account signed in. Either way, the full proof of concept has been public since 23 October, so unpatched phones are now an easier target.
Why it matters here
Plenty of New Zealand organisations rely on Authenticator on staff phones, and many of those are personal Android devices with light or no management. The attacker still needs a malicious app on the phone, but tokens taken this way sidestep MFA: they are the result of a completed sign-in, not a password.
If tokens are misused to read mail or files containing personal information, that can become a notifiable privacy breach under the Privacy Act 2020. The fix is cheap compared with the clean-up.
What to check this week
- Find your Android Authenticator versions. In Intune, look at discovered or managed apps for
com.azure.authenticatorand flag anything below 6.2606.4246. For unmanaged phones, ask staff to update from Google Play. - Push the update and hold the line. On managed Android devices, deploy Authenticator through managed Google Play so updates land automatically, and use compliance or app protection settings to flag out-of-date builds where your setup allows.
- Restrict sideloading. The attack needs a rogue app installed. On managed Android Enterprise devices, block installs from unknown sources and limit apps to managed Google Play.
- Tighten access from phones. Use Conditional Access to require compliant devices or approved apps with app protection for Microsoft 365 access from mobile.
- Review recent sign-ins. In Entra sign-in logs, look for Graph or Teams access from unusual locations or clients since early July, and revoke sessions for any account that looks wrong.
The Zenaos view
This is a patched bug, not a crisis. But it is a good reminder that the phone holding your MFA app is part of your identity perimeter. Knowing which app versions are on staff devices, and being able to block old ones, is basic hygiene that many tenants have not set up yet.
If you would like a hand checking your Intune and Conditional Access settings for mobile, get in touch.
Sources: Microsoft Security Response Center, CVE-2026-80097 (8 September 2026, updated 15 September 2026); Enclave, "AuthMask" research (23 October 2026).