A bad Android app was able to take your work sign-in. Microsoft fixed the Authenticator flaw

Microsoft Authenticator is the phone app that signs you in to other Microsoft apps, such as Teams and Outlook.

Researchers found a flaw in the Android version. Any app on the phone can pretend to be one of those apps.

The fake app then received a kind of electronic key for your work account.

With that key, someone was able to read your work email, files, and calendars, according to tests by the security company Enclave.

The researchers also showed that a fake app was able to change the account's sign-in settings. Those settings control who can sign in.

Microsoft fixed the flaw on September 8, 2026. The company gave the problem the number CVE-2026-80097.

The details became public on October 23, 2026, when the research team published its findings.

This report concerns people who use the Microsoft Authenticator app on an Android phone with a work account.

You did not need to click anything for the flaw to work. The bad app only needed to be on the phone.

A harmful app must already be installed. That usually means an app from outside the official Play Store.

The findings describe the Android version. Microsoft's fix covers the Android app.

People who use only the iPhone version are not named in the findings.

Microsoft's own advisory page is hard to read without special software. We did not open it directly.

Reports of that advisory say Microsoft does not believe anyone used the flaw. We do not know whether any phone was attacked.

We do not know how many phones carried a harmful app that was able to use this flaw.

We do not know whether the iPhone version had the same weakness. The findings describe Android only.