Microsoft patched an Android Authenticator flaw that could expose work account tokens

Cyber Security News, citing Enclave researchers, reports that a malicious app on an affected Android device could impersonate a trusted Microsoft app and receive work account tokens without user approval. The outlet says the flaw affected devices with a signed-in work account and was fixed in Authenticator version 6.2606.4246, released in July 2026.