Microsoft has fixed a vulnerability in its Authenticator app for Android that researchers say could let malicious apps obtain work-account sign-in tokens. The issue involves how Authenticator handles authentication requests from other Microsoft apps, according to the coverage, and it is now addressed in a newer Android version.
Across outlets, the reporting focuses on how an attacker app could impersonate a trusted Microsoft application and collect tokens tied to a victim’s account. Several sources emphasize that the malicious app does not need Android permissions and that users are not required to tap or explicitly approve the attack, describing it as a quiet token-stealing scenario.
The differences are mainly in the level of technical explanation: some articles highlight the “broker” role Authenticator plays for other apps such as Teams and Outlook, while others concentrate on the practical impact and the need to update promptly. One outlet also specifies the vulnerability’s CVE identifier and the Authenticator version containing the fix.
