Loading story…
A vulnerability in Microsoft Authenticator, tracked as CVE-2026-26123, allowed malicious Android and iOS apps to hijack the app’s unclaimed ms-msa:// deep link and intercept authentication tokens during onboarding and sign-in flows. The flaw affected QR-code-based setup scenarios in which a user scanned a legitimate Microsoft QR code with a mobile camera and opened the resulting link, enabling an attacker-controlled app to capture login data with little visible warning to the victim.
Researchers reported that the issue could lead to full takeover of Microsoft accounts and downstream access to services including Outlook, OneDrive, Teams, Office, and Skype. Microsoft acknowledged the vulnerability, assigned a CVE, and mitigated the issue, while coverage warned that the bug could expose login codes for large numbers of users on both major mobile platforms. Users and organizations were advised to update Microsoft Authenticator and ensure proper verified app-link handling as the primary remediation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Details of the Microsoft Authenticator deep-link vulnerability were publicly disclosed, describing how minimal user interaction could lead to interception of login tokens and full Microsoft account takeover. Public reporting also advised users to update to the latest version and highlighted proper app-link verification as the key remediation.
Microsoft acknowledged the reported issue, assigned it CVE-2026-26123, and implemented a mitigation for the vulnerability. The issue affected Microsoft Authenticator on modern Android and iOS environments and could expose access to Microsoft services such as Outlook, OneDrive, Teams, Office, and Skype.
A security researcher found that Microsoft Authenticator did not properly claim the ms-msa:// deep link used in onboarding and sign-in flows. The flaw allowed a malicious Android or iOS app to register the scheme and intercept authentication tokens from QR-code-based setup flows, enabling account takeover.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
infosecwriteups.com
Open sourcetechrepublic.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers at Enclave disclosed a vulnerability dubbed **FlagLeft** in six Microsoft 365 Android apps that allowed any co-installed third-party app to silently obtain valid Microsoft account tokens from a signed-in user. The flaw stemmed from a production debug setting, `setIsDebugMode(true)`, left enabled in a shared Microsoft SDK, which disabled the authorization check meant to ensure tokens were handed only to trusted Microsoft apps. Affected apps included **Word, PowerPoint, Excel, Microsoft 365 Copilot, Microsoft Loop, and OneNote**; **Teams** was reportedly not affected because its production debug flag was configured correctly. Because the apps relied on **FOCI** token sharing for single sign-on, a malicious Android app could potentially capture long-lived refresh tokens and access Microsoft services including **email, OneDrive files, calendars, and messaging functions** without a password, login prompt, or permission prompt. Microsoft confirmed the issue, assigned multiple CVEs—including four covering Copilot, Word, PowerPoint, and Excel with CVSS scores ranging from **4.4 to 7.7**—and shipped fixes through Google Play updates. Researchers said there was no public evidence of active exploitation before remediation, but warned that previously exposed refresh tokens may remain valid after app updates, making token revocation and verification of patched app versions important for affected organizations.
Jun 29, 2026
A phishing campaign abused Microsoft's OAuth 2.0 **Device Authorization Grant** (`Device Code Flow`) to capture valid Microsoft account tokens without sending victims to a counterfeit login page. Victims received emails posing as legal notifications, including password-protected PDF attachments, and were funneled through phishing pages that displayed a one-time device code before directing them to the legitimate `microsoft.com/devicelogin` page. After victims entered the code and completed normal MFA on Microsoft's real site, the attackers obtained `access_token`, `refresh_token`, and `id_token` values tied to attacker-controlled applications. The stolen tokens enabled persistent access to Microsoft services including **email, OneDrive, and Teams**, allowing attackers to read messages, access files, and monitor conversations. Researchers said the activity was observed from early April to mid-May 2026 and included a Brazil-focused variant that used legitimate redirect links, including on **cacoo.com**, to add credibility to the lure chain. Defenders were urged to reject unexpected device authorization prompts, inspect redirect parameters in otherwise legitimate URLs, disable Device Code Flow in Microsoft Entra ID where it is not needed, and monitor **DeviceCodeSignIn** and anomalous sign-in activity for signs of compromise.
Jul 7, 2026
Microsoft disclosed a large-scale phishing campaign that targeted more than **35,000 users** at over **13,000 organizations** across **26 countries**, with most victims in the United States and concentrations in healthcare, life sciences, financial services, professional services, and technology. The operation used code-of-conduct and compliance-themed emails delivered through legitimate email services, including abuse of platforms such as Amazon SES, to make messages appear trustworthy and help them pass common email authentication checks. Victims received PDF attachments containing links that led through fake CAPTCHA and document-review pages before landing on spoofed Microsoft sign-in portals. Microsoft said the attackers used an **adversary-in-the-middle** phishing flow to capture credentials and authentication tokens in real time, allowing them to bypass weak multifactor authentication and gain immediate account access. The company described the activity as one of the most sophisticated code-of-conduct-themed credential theft campaigns it has observed and said it reflects broader trends including CAPTCHA-gated phishing, QR-code phishing, and phishing-as-a-service ecosystems such as **Tycoon 2FA**, **Kratos**, and **EvilTokens**. Microsoft urged organizations to strengthen defenses with Defender for Office 365, SmartScreen-enabled browsers, phishing awareness training, stronger authentication, conditional access policies, and automated attack disruption in Defender XDR.
Jun 29, 2026