Microsoft Authenticator flaw let permissionless Android apps steal work account tokens

Microsoft fixed a flaw in Authenticator for Android that allowed a malicious app with no permissions to impersonate a trusted Microsoft app and obtain sign-in tokens for a victim’s work account. Microsoft says the flaw has not been exploited in attacks.