CVE-2026-80097: Microsoft Authenticator for Android — Malicious Apps Stealing Work Account Tokens

Microsoft has patched a significant vulnerability in its Authenticator app for Android that allowed malicious applications—requiring zero permissions—to impersonate trusted Microsoft applications like Teams and harvest authentication tokens for corporate accounts. Tracked as CVE-2026-80097, this flaw effectively bypassed the trust boundaries of Android's application sandbox, turning a core identity protection tool into an attack vector.

The vulnerability was addressed in Microsoft Authenticator for Android version 6.2606.4246, released in October 2026. Organizations relying on Authenticator for MFA or passwordless authentication into Microsoft 365, Azure AD (Entra ID), or other corporate resources face potential session hijacking and account takeover if devices remain unpatched.

This is not a theoretical risk. The attack requires no special permissions, no user interaction beyond installing a malicious app, and targets the very tokens used to establish trusted sessions. For defenders, this represents a direct path to bypassing MFA protections.

Technical Analysis

Affected Component and Attack Mechanics

The vulnerability resides in how Microsoft Authenticator for Android handled inter-process communication (IPC) with other applications on the device. Specifically, the app failed to properly validate the identity of calling applications before responding to authentication token requests.

In Android's security model, applications communicate via Intents—messages that request functionality from other apps. Microsoft Authenticator exposes an Activity or Service that responds to token requests from legitimate Microsoft applications (Teams, Outlook, Office, etc.). The flaw allowed any installed application to craft an Intent that appeared to originate from these trusted apps, without requiring the QUERY_ALL_PACKAGES permission or any other special privileges.

Attack Chain

1. Initial Access: Victim installs a malicious application (disguised as a utility, game, or productivity tool) from any source—official or third-party stores.
2. Token Request: The malicious app sends an Intent to Microsoft Authenticator, spoofing the package name or signature check of a trusted Microsoft app (e.g., com.microsoft.teams).
3. Token Theft: Authenticator, failing to validate the caller properly, returns a valid access token or refresh token for the victim's work account.
4. Session Hijacking: The attacker exfiltrates the token to a command-and-control server, then replays it from their own infrastructure to access Microsoft 365, SharePoint, Exchange, or other Entra ID-protected resources.

Exploitation Requirements

• No permissions required: The malicious app needs no dangerous permissions (no Accessibility, no Device Admin, no Usage Access).
• User interaction: Only installation and launch of the malicious app. No further user action needed.
• Target condition: Victim must be signed into Microsoft Authenticator with a work or school account.

Exploitation Status

As of this writing, Microsoft has not reported confirmed active exploitation in the wild. However, the low barrier to exploitation and the value of the targeted tokens make this a high-priority patching priority. Security researchers have demonstrated proof-of-concept exploitation, and weaponization by threat actors is expected.

This vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, but organizations should not wait for KEV inclusion to act.

Detection & Response

Identifying Vulnerable Devices

The primary detection challenge is identifying devices running vulnerable Authenticator versions. Mobile Device Management (MDM) and Mobile Application Management (MAM) solutions should query installed app versions across the fleet.

For organizations using Microsoft Intune, navigate to:

• Apps → All apps → Filter by "Microsoft Authenticator"
• Review App versions and identify any devices below 6.2606.4246

For VMware Workspace ONE, Jamf, or other MDM platforms, similar inventory queries apply.

Hunting for Exploitation

Detecting active exploitation requires correlating authentication anomalies with mobile device indicators. Key signals include:

• Impossible travel or atypical token usage patterns
• Authentication from unexpected IP addresses or geographies
• Token replay from non-corporate devices or unusual user agents
• Multiple concurrent sessions from disparate locations

// Hunt for suspicious token usage patterns potentially linked to CVE-2026-80097 exploitation
// Focus on authentication events from mobile devices with anomalous characteristics
SigninLogs
| where TimeGenerated > ago(7d)
| where AppDisplayName contains "Microsoft" or AppDisplayName contains "Office"
| where DeviceDetail has "Android"
| extend Location = tostring(LocationDetails.countryOrRegion)
| extend IPAddress = tostring(IPAddress)
| summarize 
    SignInCount = count(),
    UniqueIPs = dcount(IPAddress),
    UniqueLocations = dcount(Location),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated)
    by UserPrincipalName, AppDisplayName, DeviceDetail
| where UniqueIPs > 3 or UniqueLocations > 2
| project UserPrincipalName, AppDisplayName, SignInCount, UniqueIPs, UniqueLocations, FirstSeen, LastSeen
| order by UniqueIPs desc

// Correlate risky sign-ins with mobile device registration
// Look for new device registrations followed by immediate high-risk activity
AuditLogs
| where TimeGenerated > ago(14d)
| where OperationName == "Add device" or OperationName == "Register device"
| extend DeviceId = tostring(TargetResources[0].id)
| extend UserId = tostring(TargetResources[0].userPrincipalName)
| join kind=inner (
    SigninLogs
    | where TimeGenerated > ago(14d)
    | where RiskLevelDuringSignIn in ("high", "medium") or RiskLevelAggregated in ("high", "medium")
    | project UserId, TimeGenerated, IPAddress, LocationDetails, AppDisplayName, RiskLevelDuringSignIn
) on UserId
| project UserId, DeviceId, TimeGenerated, IPAddress, LocationDetails, AppDisplayName, RiskLevelDuringSignIn
| order by TimeGenerated desc

// Detect potential token replay from suspicious infrastructure
// Focus on access to sensitive workloads from non-compliant or unknown devices
SigninLogs
| where TimeGenerated > ago(7d)
| where AppDisplayName in ("Microsoft Teams", "Microsoft Outlook", "SharePoint Online", "Exchange Online")
| where ConditionalAccessStatus != "success" or DeviceDetail.isCompliant == false
| where IPAddress !startswith "10." and IPAddress !startswith "192.168." and IPAddress !startswith "172.16."
| extend GeoLocation = tostring(LocationDetails.countryOrRegion)
| summarize AccessCount = count() by UserPrincipalName, IPAddress, GeoLocation, AppDisplayName, ConditionalAccessStatus
| where AccessCount > 5
| order by AccessCount desc

Endpoint Detection via Sigma

While the vulnerability itself is mobile-specific, post-exploitation activity on endpoints accessing corporate resources can be detected through traditional means.

---
title: Suspicious Token Usage from Unexpected Geographic Location
id: 8f4a2b1c-3d5e-4f6a-9b8c-1e2d3f4a5b6c
status: experimental
description: Detects authentication to Microsoft 365 services from geographic locations inconsistent with user baseline, potentially indicating token theft via CVE-2026-80097.
references:
  - https://thehackernews.com/2026/10/microsoft-authenticator-flaw-let.html
  - https://attack.mitre.org/techniques/T1550/001/
author: Security Arsenal
date: 2026/10/27
tags:
  - attack.initial_access
  - attack.t1550.001
logsource:
  product: azure
  service: signinlogs
detection:
  selection:
    location: 
      - 'RU'
      - 'CN'
      - 'KP'
      - 'IR'
    app_display_name:
      - 'Microsoft Teams'
      - 'Microsoft Outlook'
      - 'Office 365'
      - 'SharePoint Online'
  condition: selection
falsepositives:
  - Legitimate travel by users
  - VPN usage from corporate-approved providers
level: high
---
title: Multiple Failed Conditional Access Evaluations from Mobile Device
id: 9a5b3c2d-4e6f-5a7b-8c9d-2e3f4a5b6c7d
status: experimental
description: Identifies repeated Conditional Access policy failures from Android devices, potentially indicating token replay attempts from stolen credentials.
references:
  - https://thehackernews.com/2026/10/microsoft-authenticator-flaw-let.html
  - https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2026/10/27
tags:
  - attack.defense_evasion
  - attack.t1078
logsource:
  product: azure
  service: signinlogs
detection:
  selection:
    conditional_access_status: 'failure'
    device_detail.operating_system: 'Android'
    device_detail.is_compliant: false
  condition: selection
falsepositives:
  - Legitimate non-compliant device access attempts
  - Conditional Access policy misconfigurations
level: medium

Velociraptor VQL for Mobile Forensics

For organizations performing forensic analysis on potentially compromised Android devices, Velociraptor can hunt for indicators of malicious app installation and token access attempts.

-- Hunt for recently installed packages with suspicious characteristics
-- Focus on apps installed outside the Play Store or with minimal permissions
SELECT 
    FullPath,
    Name,
    Size,
    Mtime,
    Ctime
FROM glob(globs='/data/app/*/base.apk')
WHERE Mtime > ago(7d)
ORDER BY Mtime DESC

-- Examine running processes for potential token theft activity
-- Look for non-Microsoft apps with unusual network connectivity
SELECT 
    Pid,
    Name,
    CommandLine,
    Exe,
    Username
FROM pslist()
WHERE Name =~ 'teams|outlook|office|authenticator'
   OR CommandLine =~ 'token|auth|oauth|bearer'

-- Network connections from potentially malicious apps
-- Correlate with process information to identify suspicious exfiltration
SELECT 
    Pid,
    Name,
    Status,
    DestAddr,
    DestPort
FROM netstat()
WHERE DestPort in (443, 8443, 8080)
  AND Status == 'ESTABLISHED'

Remediation

Immediate Actions

1. Update Microsoft Authenticator

Force update all Android devices to Microsoft Authenticator version 6.2606.4246 or later. This is the only version confirmed to remediate CVE-2026-80097.

For Intune-managed devices:

• Navigate to Apps → Android → Microsoft Authenticator
• Set Minimum version to 6.2606.4246
• Configure Require app update or Wipe device if minimum version not met based on risk tolerance

For unmanaged/BYOD devices, communicate urgency to users and provide direct Play Store links.

2. Conditional Access Policy Hardening

Implement or strengthen Conditional Access policies to limit token usability even if stolen:

• Require compliant device for all corporate resource access
• Require approved client app for mobile access
• Block legacy authentication entirely
• Implement token protection (preview) for Exchange Online and SharePoint Online

3. Session and Token Revocation

For high-risk users or suspected compromise:

• Revoke all refresh tokens for affected users via Entra ID → Users → Revoke sessions
• Force re-authentication on all devices
• Review Risky users and Risky sign-ins reports for anomalies

4. Application Control

Deploy mobile application management (MAM) policies to:

• Block installation of apps from unknown sources
• Require Play Store verification for all installed apps
• Maintain an allowlist of approved applications for work profile access

Verification Script

Use the following PowerShell script with Microsoft Graph to identify users with outdated Authenticator versions registered as authentication methods:

# Requires Microsoft.Graph PowerShell module
# Connect-MgGraph -Scopes "UserAuthenticationMethod.Read.All, DeviceManagementManagedDevices.Read.All"

$VulnerableVersion = "6.2606.4246"
$Report = @()

# Get all users with Microsoft Authenticator registered
$Users = Get-MgUserAuthenticationMethod -All | Where-Object {
    $_.AdditionalProperties.'@odata.type' -eq '#microsoft.graph.microsoftAuthenticatorAuthenticationMethod'
}

foreach ($User in $Users) {
    $AuthMethod = Get-MgUserAuthenticationMethod -UserId $User.UserId -AuthenticationMethodId $User.Id
    $DeviceName = $AuthMethod.AdditionalProperties.deviceName
    $AppVersion = $AuthMethod.AdditionalProperties.clientAppVersion
    
    if ($AppVersion -and [version]$AppVersion -lt [version]$VulnerableVersion) {
        $Report += [PSCustomObject]@{
            UserPrincipalName = $User.UserPrincipalName
            DeviceName = $DeviceName
            AppVersion = $AppVersion
            Status = "VULNERABLE"
        }
    }
}

$Report | Export-Csv -Path "Authenticator_Vulnerability_Report.csv" -NoTypeInformation
Write-Host "Found $($Report.Count) potentially vulnerable devices" -ForegroundColor Red

Long-Term Defensive Measures

1. Zero Trust Architecture: Assume breach and verify explicitly. Token theft is mitigated by continuous validation, not point-in-time authentication.

2. Hardware-Backed Authentication: Where possible, migrate to passkeys or certificate-based authentication with hardware-backed key storage (TEE/StrongBox on Android, Secure Enclave on iOS).

3. Mobile Threat Defense (MTD): Deploy MTD solutions (Microsoft Defender for Endpoint, Lookout, Zimperium) to detect malicious apps before installation.

4. User Education: Train users to scrutinize app installation requests, even from official stores. Emphasize that MFA fatigue attacks and token theft often follow social engineering.

Official References

• Microsoft Security Update Guide - CVE-2026-80097
• Microsoft Authenticator for Android Release Notes
• Android Security Bulletin - October 2026

Related Resources

Security Arsenal Red Team Services AlertMonitor Platform Book a SOC Assessment pen-testing Intel Hub