Loading story…
Researchers at Enclave disclosed a vulnerability dubbed FlagLeft in six Microsoft 365 Android apps that allowed any co-installed third-party app to silently obtain valid Microsoft account tokens from a signed-in user. The flaw stemmed from a production debug setting, setIsDebugMode(true), left enabled in a shared Microsoft SDK, which disabled the authorization check meant to ensure tokens were handed only to trusted Microsoft apps. Affected apps included Word, PowerPoint, Excel, Microsoft 365 Copilot, Microsoft Loop, and OneNote; Teams was reportedly not affected because its production debug flag was configured correctly.
Because the apps relied on FOCI token sharing for single sign-on, a malicious Android app could potentially capture long-lived refresh tokens and access Microsoft services including email, OneDrive files, calendars, and messaging functions without a password, login prompt, or permission prompt. Microsoft confirmed the issue, assigned multiple CVEs—including four covering Copilot, Word, PowerPoint, and Excel with CVSS scores ranging from 4.4 to 7.7—and shipped fixes through Google Play updates. Researchers said there was no public evidence of active exploitation before remediation, but warned that previously exposed refresh tokens may remain valid after app updates, making token revocation and verification of patched app versions important for affected organizations.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Researchers publicly disclosed that several Microsoft 365 Android apps could hand account tokens to any malicious app on the same device without user interaction, potentially exposing email, OneDrive, calendars, and messaging capabilities. The disclosure also noted there was no public evidence of exploitation before the fix.
Researchers at Enclave identified an Android vulnerability dubbed FlagLeft in a shared Microsoft SDK that let any co-installed app silently obtain valid Microsoft account tokens from several Microsoft 365 apps. The issue was traced to a production debug setting, setIsDebugMode(true), which disabled the authorization check meant to restrict token sharing to trusted Microsoft apps.
On 2026-05-12, Microsoft confirmed the issue, assigned multiple CVEs, and released Google Play updates for affected apps including Copilot, Word, PowerPoint, and Excel. The flaw affected Word, PowerPoint, Excel, Microsoft 365 Copilot, Microsoft Loop, and OneNote, while Teams was reported as not affected.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcecybersecuritynews.com
Open sourceenclave.ai
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A vulnerability in Microsoft Authenticator, tracked as **CVE-2026-26123**, allowed malicious Android and iOS apps to hijack the app’s unclaimed `ms-msa://` deep link and intercept authentication tokens during onboarding and sign-in flows. The flaw affected QR-code-based setup scenarios in which a user scanned a legitimate Microsoft QR code with a mobile camera and opened the resulting link, enabling an attacker-controlled app to capture login data with little visible warning to the victim. Researchers reported that the issue could lead to full takeover of Microsoft accounts and downstream access to services including **Outlook, OneDrive, Teams, Office, and Skype**. Microsoft acknowledged the vulnerability, assigned a CVE, and mitigated the issue, while coverage warned that the bug could expose login codes for large numbers of users on both major mobile platforms. Users and organizations were advised to update Microsoft Authenticator and ensure proper verified app-link handling as the primary remediation.
Jun 29, 2026
Microsoft disclosed **CVE-2026-42835**, an Important-severity information disclosure vulnerability in **Microsoft Teams for Android** that could allow a remote, authenticated low-privileged attacker to access small portions of heap memory without user interaction. The flaw, classified as **CWE-74** for improper neutralization of special elements in output used by a downstream component, carries a **CVSS 3.1 score of 8.1** and may expose sensitive runtime data including authentication tokens, session information, or cached credentials. Microsoft said the vulnerability was responsibly reported by **Ofek Levin of Enclave** through its coordinated disclosure program and has released a security update through the **Google Play Store**. The company stated that exploitation is considered less likely and that it had seen no public disclosure or evidence of active exploitation at the time of publication, but organizations using Teams for sensitive internal communications were urged to update affected Android clients promptly.
Jun 29, 2026
Microsoft disclosed and patched **CVE-2026-32185**, an **Important** spoofing vulnerability in **Microsoft Teams for Android** caused by improper access to files or directories, mapped to `CWE-552`. The flaw could allow an unauthorized **local attacker** to spoof trusted elements in the app and potentially trick users into accepting malicious content or communications. Microsoft assigned the issue a **CVSS 3.1 score of 5.5** and said exploitation requires local access and user interaction, but could still have a high confidentiality impact. Microsoft said the vulnerability was **not publicly disclosed**, **not exploited in the wild**, and had **no public proof-of-concept** at the time of publication, with exploitation assessed as less likely. The company released a fix through the **Google Play Store** and advised users to update **Microsoft Teams for Android** to version **`1.0.0.2026092103` or later**. Microsoft credited **Ofek Levin of Enclave** with responsibly reporting the issue.
Jun 29, 2026