Because the legitimate Teams app was frequently present on the same device, attackers could use its public signature to satisfy improper verification protocols. This discovery by security researchers at Enclave exposed a significant vulnerability in how Microsoft Authenticator handled local identity requests on Android devices. Identified as CVE-2026-80097, the flaw allowed malicious applications to bypass standard security boundaries without requesting any special Android permissions. This effectively neutralized the sandbox protections typically expected from a mobile operating system. When a user has a signed-in work account, the Authenticator app acts as a broker, managing sensitive credentials for various productivity tools. However, the specific implementation of the broker’s communication channel contained a logical oversight that turned a trusted security tool into a potential gateway for corporate data exfiltration. The risk is particularly acute for enterprises where mobile devices are central to daily operations.
The Vulnerability: Mechanisms of Identity Spoofing
The core of the problem resided in an exported Android activity known as AccountChooserActivity, which served as a public-facing entry point for apps seeking authentication tokens. In the Android ecosystem, an exported activity can be invoked by any application installed on the same device, creating a bridge for inter-app communication. A malicious application could initiate a request to this activity by crafting a specific intent bundle that included the package name, client ID, and redirect URI of a legitimate, trusted Microsoft application like Teams. The vulnerability emerged because Microsoft Authenticator prioritized the metadata provided within the intent over the actual identity of the calling application. Instead of verifying the caller’s unique User ID provided by the Android system, the broker relied on the provided package name to validate the redirect URI. This architectural blind spot meant that the broker would authorize the token release to an unauthorized entity without any verification.
By exploiting this lack of rigorous verification, an attacker could effectively impersonate a trusted app to the Authenticator broker. This process required no user interaction or credential entry, as the broker assumed the request was legitimate based on the public-facing attributes of the targeted Microsoft service. Furthermore, the fact that the legitimate app usually resided on the device provided the necessary cryptographic context to satisfy secondary checks. The system-level failure to cross-reference the calling app’s signing certificate with the claimed identity allowed the malicious actor to receive a bundle containing highly sensitive data. This data included OAuth 2.0 access tokens and refresh tokens, which are the digital keys needed to access cloud resources without further multi-factor authentication. Such a flaw demonstrates the critical importance of implementing zero-trust principles even within local device communications, where the proximity of apps does not equal inherent trustworthiness at any level.
Security Impact: Consequences of Token Theft
Once a malicious application successfully intercepted these authentication bundles, the potential for data exposure became vast and deeply concerning for enterprise security teams. With the stolen access and refresh tokens, an attacker could gain delegated permissions to the Microsoft Graph API, acting on behalf of the compromised user. Depending on which client application was impersonated, the scope of access could include reading and sending emails through Outlook, downloading sensitive files from OneDrive, or accessing corporate intranets hosted on SharePoint. The stolen tokens provided a persistent foothold in the victim’s digital environment, as refresh tokens could be used to generate new access tokens for extended periods. This bypasses the traditional security perimeter, making it incredibly difficult for standard monitoring tools to detect the intrusion since the traffic appears to originate from a valid, authenticated session belonging to a legitimate employee within the organization through the standard identity provider.
Beyond mere data theft, the ability to interact with Microsoft Teams services opened avenues for internal lateral movement and social engineering. An attacker could monitor private conversations, join internal meetings, or distribute malicious files to other employees while appearing as a trusted colleague. This level of access undermines the fundamental trust within a corporate communication platform, turning a productivity tool into a weaponized asset for the adversary. Furthermore, because the initial exploit required no permissions, the malicious application could operate silently in the background, evading detection by users who only look for suspicious permission requests during installation. The impact of this vulnerability highlights a shift in the threat landscape where logic flaws in identity providers are prioritized over traditional malware techniques. Organizations must recognize that even sanctioned security applications can introduce risks if the underlying inter-process communication is not hardened against identity spoofing in a multi-app environment.
Remediation: Closing the Security Gap
Microsoft recognized the severity of this issue and released a critical update for the Android application in July 2026, designated as version 6.2606.4246. This patch modified the verification logic within the AccountChooserActivity to ensure that the identity of any calling application was strictly validated using system-level attributes. Developers moved away from trusting the metadata provided in intents and instead implemented checks that verified the caller’s signing certificate against a whitelist of authorized Microsoft applications. This correction ensured that even if a malicious app provided the correct package name and redirect URI, the broker would refuse the token request because the digital signature did not match the expected values. Administrators were encouraged to verify that all managed devices were running the latest version of the Authenticator app to close this loophole. This response underscored the necessity for rapid patch management in an era where mobile vulnerabilities can be weaponized quickly to target sensitive corporate credentials.
To further secure their environments, security professionals implemented broader mobile application management policies that went beyond simple patching. They restricted the installation of applications from unverified sources and utilized enterprise mobility management tools to monitor for anomalies in application behavior. The industry moved toward a model where identity brokers required explicit user confirmation for every new token request, regardless of the perceived trust level of the calling application. This layered defense strategy aimed to mitigate the impact of future zero-day vulnerabilities in the authentication chain. By reviewing audit logs for unusual Microsoft Graph activity, teams were able to identify potential signs of token abuse before significant damage occurred. These actions transitioned the focus from reactive fixing to proactive resilience, ensuring that the lessons learned from this vulnerability informed a more robust architecture for mobile identity management. This experience proved that continuous verification was the only viable path for protecting corporate assets.
