Microsoft Authenticator vulnerability let rogue Android apps steal work account access

A patched flaw in Microsoft Authenticator for Android let malicious apps impersonate trusted Microsoft apps and obtain work-account tokens, exposing email, files, and calendars in researchers' tests. Microsoft says exploitation requires a user to complete a sign-in flow and reports no known attacks. The fix is available in version 6. 2606. 4246 and later.