Microsoft Authenticator Android flaw enables permissionless work token theft

Tue, 27 Oct 2026 16:34:51 +0000

Engineer — Plan: Public PoC exists on GitHub but EPSS is 0.01 and not KEV-listed, so no active exploitation pressure yet. Push Authenticator for Android version 6.2606.4246 via MDM to all enrolled devices and verify compliance through your endpoint management console.
SOC/IR — Learn: The technique — a permissionless Android app impersonating a trusted Microsoft app to harvest Entra/work tokens — is worth understanding for future detection work (e.g., anomalous sign-in source patterns in Entra logs), but no IOCs or active campaign have been reported.
Leader — Skip
Signals: CVE-2026-80097 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub

Mfa-Vulnerability on CuraSec