```
Microsoft has patched a flaw in Authenticator for Android that allowed a malicious app holding no Android permissions to masquerade as a trusted Microsoft application — such as Teams — and capture sign-in tokens for a victim's work account. The disclosure was reported by The Hacker News, which carried the story in October 2026.
The vulnerability, tracked as CVE-2026-80097, is fixed in Authenticator for Android version 6.2606.4246. Microsoft's advisory asks anyone running the app to update promptly.
Beyond updating the app, security teams should assume any token issued to a vulnerable device may be compromised until it has been revoked server-side — a step that sits outside Microsoft's patch advisory and is on administrators, not the vendor.
Why token theft matters more than credential theft
The mechanism is worth pausing over. The attack does not harvest a username and password, and it does not trick the user into typing a code. It captures the session token issued after authentication has already succeeded — the adversary inherits a live, authenticated session rather than breaking the credential itself.
For anyone whose security posture rests on the assumption that multi-factor authentication closes this class of risk, the assumption is doing more work than it can. MFA validates a moment; a stolen token carries that moment forward.
Two details make this particularly awkward for defenders:
- Zero permissions. The malicious app requested no Android permissions, so there were no permission prompts to raise suspicion. Minimal-permission allowlists and user vigilance — both reasonable controls — offered no defence signal here.
- Trusted-app impersonation. Because the app could pose as Teams, it defeated the mental model users rely on: "does this look like a Microsoft app?"
Together, the design defeats two standard controls at once, which is what makes the flaw operationally significant rather than merely theoretical.
What administrators should do
For Microsoft 365 administrators, the remediation sequence is concrete:
- Force-update Authenticator on all managed Android devices to version 6.2606.4246 or later, and push the update to employee-owned devices through your MDM where policy permits.
- Revoke outstanding Entra ID tokens for affected user accounts so any captured session tokens are invalidated server-side — patching the app does not un-steal an already-taken token.
- Harden Conditional Access to require compliant or approved devices for access to sensitive workloads, reducing the value of a token replayed from an unmanaged device.
- Review your Entra ID sign-in logs for anomalous sign-in patterns and unexpected device or location activity as a follow-up check.
- Reassess app-vetting policy: a zero-permission app can still be hostile, so permission-count alone should not be treated as a trust signal.
The flaw is broadly relevant to organisations in Hong Kong running Microsoft 365 across mixed managed and employee-owned devices. The mechanism is what drives that relevance: BYOD environments concentrate exactly the conditions the attack needs — unmanaged apps, high-value work tokens sitting on personal hardware, and users expected to judge app trustworthiness by appearance.
The available reporting does not detail the root cause or impersonation vector, whether iOS is affected, or who the researchers behind the disclosure are. The Hacker News report did not include a CVSS score or state whether the flaw has been exploited in the wild; neither is asserted here.
The wider lesson for IT teams is uncomfortable: the apps guarding your identity are themselves part of the attack surface. Authenticator exists to make sign-in safer, and in this case its integration with the rest of the Microsoft app ecosystem was precisely what an attacker could borrow.
微軟已修補 Android 版 Authenticator 的一項漏洞，該漏洞容許惡意應用程式在不持有任何 Android 權限的情況下，冒充受信任的微軟應用程式（例如 Teams），並擷取受害者工作帳戶的登入 token。有關披露由 The Hacker News 報道，並於 2026 年 10 月刊出。
該漏洞編號為 CVE-2026-80097，已在 Android 版 Authenticator 6.2606.4246 版本中修補。微軟的公告呼籲所有使用該應用程式的用戶盡快更新。
除了更新應用程式之外，保安團隊應假設任何發予受影響裝置的 token 均可能已遭洩露，直至該 token 在伺服器端被撤銷為止——此一步驟並不在微軟補丁公告之列，屬於管理員的責任，而非供應商的責任。
為何 token 盫取比憑證竊取更為嚴重
此攻擊機制值得細看。攻擊並非收集用戶名稱和密碼，亦不會誘騙用戶輸入驗證碼；它擷取的是在驗證完成之後發出的 session token——敵對者繼承的是一個仍然有效、已通過驗證的 session，而非破解憑證本身。
對於任何以「多因素驗證（MFA）可關閉此類風險」為前提的保安部署而言，該假設所能承受的壓力已遠超其極限。MFA 驗證的只是一個時刻；被竊取的 token 則把該時刻延續下去。
兩個細節令防守方面對的情況尤其棘手：
- 零權限。 惡意應用程式沒有申請任何 Android 權限，因此不會觸發任何引起懷疑的權限提示。最小權限 allowlist 及用戶警覺性——兩者本身均屬合理的防禦措施——在此完全未能提供任何防禦訊號。
- 冒充受信任應用程式。 由於該應用程式可以冒充 Teams，它擊破了用戶依賴的判斷模式：「這個看起來是否像微軟的應用程式？」
綜合而言，該設計同時繞過兩項標準防禦，正因如此，這項漏洞在實務操作層面具有重大意義，而不僅僅是理論上的風險。
管理員應採取的行動
對於 Microsoft 365 管理員而言，補救步驟具體如下：
- 強制更新 Authenticator，將所有受管理的 Android 裝置升級至 6.2606.4246 或以上版本，並在政策允許的情況下，透過 MDM 將更新推送至員工自置裝置。
- 撤銷尚未失效的 Entra ID token（針對受影響的用戶帳戶），令所有已被擷取的 session token 在伺服器端失效——修補應用程式並不能令已被竊取的 token 自動失效。
- 加強 Conditional Access 政策，要求存取敏感工作負載時必須使用合規或已核准的裝置，從而降低由未受管理裝置重放 token 的價值。
- 檢視 Entra ID 登入記錄，排查異常登入模式及意料之外的裝置或位置活動，作為後續核查。
- 重新評估應用程式審核政策：零權限的應用程式仍可能具敵意，因此不應單以權限數量作為信任指標。
此漏洞對香港使用 Microsoft 365、兼有受管理裝置及員工自置裝置的機構均有廣泛關聯。帶出此關聯的正是其攻擊機制：BYOD 環境恰好集中了攻擊所需的條件——未受管理的應用程式、存放在個人硬件上的高價值工作 token，以及被期望單憑外觀判斷應用程式可信度的用戶。
現有報道並未詳述根本原因及冒充途徑、iOS 是否受影響，以及披露背後的研究人員身份。The Hacker News 的報道亦未提供 CVSS 評分，亦未說明漏洞是否已在野外被利用；本文同樣不作此斷言。
對 IT 團隊而言，更廣泛的教訓令人不安：負責守護你身分的應用程式，本身正是攻擊面的一部分。 Authenticator 的存在是為了令登入更安全，但在是次事件中，它與微軟應用程式生態系統的整合，恰恰成為攻擊者可以借用的工具。