Microsoft Authenticator for Android flaw let permissionless apps steal work-account tokens

Microsoft fixed a flaw in Microsoft Authenticator for Android that allowed a malicious app with no permissions to impersonate a trusted Microsoft app and collect sign-in tokens for a victim’s work account. Microsoft says the flaw has not been exploited in attacks.