- Engineer — Plan: Public PoC exists on GitHub but EPSS is 0.01 and not KEV-listed, so no active exploitation pressure yet. Push Authenticator for Android version 6.2606.4246 via MDM to all enrolled devices and verify compliance through your endpoint management console.
- SOC/IR — Learn: The technique — a permissionless Android app impersonating a trusted Microsoft app to harvest Entra/work tokens — is worth understanding for future detection work (e.g., anomalous sign-in source patterns in Entra logs), but no IOCs or active campaign have been reported.
- Leader — Skip
- Signals: CVE-2026-80097 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub