AuthMask flaw lets Android apps steal Microsoft tokens

Security researcher Ofek Levin has disclosed a chain of flaws named AuthMask that allows Android apps to hijack corporate authentication tokens used by Microsoft Authenticator. The issue, tracked as CVE-2026-80097, arises when the Android-based authentication broker can be fed with custom application metadata. Malicious software can impersonate legitimate Microsoft apps installed on the same device, enabling exfiltration of tokens and access to cloud resources.

The claim is that the broker validates redirect parameters against the claimed identity rather than the caller, meaning an untrusted utility could pose as Microsoft Teams and obtain valid tokens because genuine Teams signatures exist locally. This creates a pathway for token theft and broader compromise of enterprise services.

The research details a wide potential impact across Microsoft Graph API and related services, with attackers potentially reading personal messages, sending fraudulent communications, editing calendars, and exfiltrating SharePoint documents. In addition, attackers could obtain valid refresh tokens to renew sessions indefinitely and could alter authentication settings or register unauthorised passkeys.

Microsoft released a fix as version 6.2606.4246 on 8 September to address the validation failure, following responsible disclosure in advance of public release. The disclosure notes that unpatched Android devices remain vulnerable to emerging automated exploits, and administrators are advised to deploy the update across corporate fleets.