A newly published report by cybersecurity expert Ofir Levin details the AuthMask attack chain: a malicious Android application can exploit a vulnerability (designated as CVE-2026-80097) within Microsoft Authenticator to impersonate pre-installed Microsoft apps via an authentication broker. This allows the malicious app to obtain account tokens without requiring user confirmation or explicit permissions. The root cause of this vulnerability lies in the Authenticator's broker component, which fails to adequately verify the identity of the entity requesting authentication. Consequently, malicious apps can circumvent security measures by falsifying details such as the app package name. Microsoft has acknowledged the existence of this local privilege escalation vulnerability and has remediated it through a software update released in September 2026. Users affected by this vulnerability are strongly advised to update to the latest version of Microsoft Authenticator promptly to minimize potential risks.