> TritonInfoSec News
Home / Oct 28, 2026 / Story
0
#5 The Hacker News general October 27, 2026 at 12:09 UTC

Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens

By [email protected] (The Hacker News)

AI Summary

Microsoft patched CVE-2026-80097 in Microsoft Authenticator for Android (fixed in version 6.2606.4246), a flaw that allowed a zero-permission malicious app to impersonate trusted Microsoft applications like Teams and harvest work account sign-in tokens. Successful exploitation could enable full account takeover without requiring any special Android permissions, making it particularly dangerous in BYOD enterprise environments. All users of Microsoft Authenticator for Android should update immediately.

Read full article → https://thehackernews.com/2026/10/microsoft-authen…

Relevance score: 84.0/100

# More from October 28

  1. 1
    Code-execution flaw in UEFI firmware threatens most servers on planet Earth Ars Technica Security
  2. 2
    CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution The Hacker News
  3. 3
    Lazarus Abuses South Korean Security Software to Deploy Malware Using Post-Quantum Encryption The Hacker News
  4. 4
    Apple Backports Fix for Exploited CoreGraphics Flaw to Older iPhones and iPads The Hacker News
  5. 6
    Australia Gets Into Amadey Malware Backend, Cuts Off Access to 180,000 Infected Computers The Hacker News
  6. 7
    Keystone to Destroy 18,835 Hardware Wallets After Hackers Steal Device Verification Key The Hacker News
  7. 8
    Tailscale warns of SSH flaws allowing root privilege escalation BleepingComputer
  8. 9
    UNM Health ransomware attack disrupts patient care, surgeries BleepingComputer
  9. 10
    HPE Patches Dozens of Critical Flaws in Networking Products SecurityWeek