Do Son 
Security researcher Ofek Levin recently unveiled a severe vulnerability chain named AuthMask. Specifically, this flaw tracked as CVE-2026-80097 allowed malicious Android applications to hijack corporate authentication tokens. Rogue software bypassed security barriers by impersonating legitimate Microsoft applications installed on the same device. Consequently, attackers could exfiltrate sensitive credentials and compromise corporate cloud resources effortlessly.
Exploiting Authentication Broker Trust Mechanisms
Microsoft Authenticator often functions as an enterprise authentication broker rather than a simple code generator. Under this operational model, the app brokers single sign-on access to Microsoft 365 environments. However, architectural gaps in exported app components created an insidious privilege escalation pathway. As detailed in the research analysis of the AuthMask attack chain, external programs could specify custom application metadata. Calling software freely submitted their own application name, package identifier, client identity, and redirect URI.
Crucially, the broker verified redirect parameters against the claimed identity rather than the actual caller. For instance, an untrusted utility could impersonate Microsoft Teams. Because legitimate Teams package signatures existed on the local filesystem, the broker validated the fraudulent request. Therefore, the authentication broker delivered legitimate authorization tokens directly into the hands of the adversary.
Extensive Scope Across Graph API and Passkeys
Consequently, this token theft gave attackers broad access across enterprise infrastructures. For example, impersonating Microsoft Teams granted attackers extensive Microsoft Graph API privileges. Threat actors could read personal correspondence, send fraudulent messages, modify calendars, and exfiltrate SharePoint documents. Furthermore, adversaries received valid refresh tokens to renew unauthorized sessions indefinitely.
Subverting Account Governance and Passkey Security
Moreover, the security threat extended far beyond unauthorized data collection. Specifically, attackers could manipulate underlying authentication settings across corporate profiles. Intruders could register unauthorized passkeys or delete existing cryptographic credentials. Therefore, the breach compromised fundamental account governance alongside user communication data.
Patch Availability and Coordinated Disclosure Timeline
Fortunately, the security researcher disclosed these vulnerabilities responsibly to Microsoft before public release. The security defect primarily compromised Android builds running versions 6.0.0 through 6.2606.4246. In response, Microsoft distributed version 6.2606.4246 on September 8 to resolve the validation failure.
To safeguard enterprise users, researchers delayed technical publications for nearly two months. However, public disclosure now leaves unpatched mobile fleets exposed to emerging automated exploits. Therefore, enterprise administrators must enforce immediate updates across all corporate Android devices to neutralize this threat.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
