Microsoft Authenticator vulnerability let rogue Android apps steal work account access If you use Microsoft Authenticator on Android, update it. Researchers at Enclave found a flaw that let any app on your phone quietly take over your work account. The app didn’t need permissions, and you didn’t need to tap anything. Here’s what happened Authenticator does more than show six-digit codes. On Android it also acts as a “broker.” When Teams, Outlook or another Microsoft app needs to sign you in, it asks Authenticator, and Authenticator hands back a token: a digital pass that proves you’re logged in. Because Authenticator controls access to your whole Microsoft account, it’s supposed to be very careful about which apps it gives those tokens to. Ofek Levin, a researcher on Enclave’s fellowship…