Token Theft
Security incidents tagged Token Theft. Newest first.
1 Token Theft incident in the last 12 months
- Incidents
- 1
- Live
- 1
- Patched
- 1
- Days without an incident
- 4
- Longest quiet run: 44 days (Sep 9–Oct 22)
- Patched
Microsoft Authenticator for Android: any app could impersonate Teams or Outlook and get work-account tokens (AuthMask, CVE-2026-80097)
Microsoft Authenticator on Android acts as the sign-in broker for Microsoft apps, and an exported activity in it handed out tokens without checking which app was really asking. A malicious app with zero permissions could claim to be an installed Microsoft app such as Teams and get that app's tokens for the work account signed into Authenticator. Enclave researcher Ofek Levin, who found it, says the tokens gave full delegated mailbox, files and calendar access, and that by posing as Authenticator itself an attacker could change the account's sign-in methods, including adding passkeys that keep access after the app is removed. It needs a malicious app installed on the phone. Microsoft fixed it in September 2026; update Authenticator for Android to 6.2606.4246 or later.
Microsoft Authenticator for AndroidSince Oct 23, 2026
