Microsoft Authenticator could leak login codes

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Bug in Microsoft Authenticator Allows Code Interception on Mobile Devices A vulnerability in Microsoft Authenticator for Android and iOS could enable malicious apps on the same device to intercept authentication codes or sign-in links. This issue affects users of both platforms who utilize the app for two-factor authentication. The attack vector involves the exploitation of the app's code, potentially allowing unauthorized access to user accounts. While specific numbers of affected users are not provided, the widespread use of Microsoft Authenticator suggests a significant potential impact. The current status of the vulnerability is under investigation, with users advised to update their apps immediately. No CVEs have been disclosed in the articles, indicating that this may be a newly discovered issue. Security professionals are urged to monitor for updates from Microsoft regarding this vulnerability. The situation is evolving, and further details may emerge as the investigation continues. 3 sources 58