Microsoft Authenticator Android flaw lets rogue apps steal work accounts

En bref

• Flaw affects Microsoft Authenticator on Android.
• Rogue apps on the same phone could gain work-account access.
• Teams and Outlook identities are in scope.
• Microsoft released a patch; update Authenticator immediately.
• Severity is medium and no CVE was listed.

On 2026-10-27, Enclave researchers reported a security weakness involving Microsoft's Authenticator app on Android. The flaw creates a route for hostile applications installed on the same handset to obtain access to a user's work account. Microsoft has issued a patch, and the primary remediation is to update Authenticator.

Accounts that rely on Authenticator for sign-in are the focus, including identities used with Teams and Outlook. If a rogue app succeeds, the result can be account takeover rather than a simple nuisance prompt: an attacker could gain the access needed to read mail, join chats, or reach other connected services. That makes the issue relevant to both end users and the IT teams that manage Microsoft 365 identities.

The exposure is broad in scope because it concerns Android users and the presence of any app on the phone. Researchers' description does not require a targeted exploit chain against a specific app; the risk model is malicious software already installed alongside Authenticator. No CVE identifier was included in the available facts, and the severity is rated medium, but medium should not be read as harmless when work credentials are involved.

Because the fix is a patch release, the most effective immediate step is version hygiene. Administrators should confirm that managed Android devices have the updated Authenticator build, then check unmanaged or BYOD devices through conditional access and compliance signals. Sign-in monitoring for Teams and Outlook can help identify unusual activity while updates propagate.

Watch for follow-up vendor guidance, any revision to severity, and evidence of rogue-app installation on user devices. Treat unpatched Android handsets as higher risk until Authenticator is current.

À faire maintenant

1. Update Microsoft Authenticator on every Android device to the latest patched release; verify versions through MDM or EMM reporting.
2. Inventory Android apps and remove sideloaded or unknown software; enforce allowlists where feasible.
3. Review Teams and Outlook sign-in logs for anomalous sessions, then revoke tokens and force reauthentication if compromise is suspected.
4. Apply conditional access so only compliant, patched Android devices can reach work accounts.
5. Tell staff to install the Authenticator update immediately and to report unexpected sign-in prompts or unfamiliar apps.
6. Monitor Microsoft and Enclave advisories for patch details, CVE assignment, or changes to severity.
7. For high-risk accounts, rotate credentials and re-register MFA after cleaning affected devices.

Source originale

Help Net Security