MICROSOFT AUTHENTICATOR FLAW EXPOSES WORK ACCOUNTS

Summary from the TLDR IT newsletter

A patched flaw in Microsoft Authenticator for Android let malicious apps impersonate trusted Microsoft apps and obtain work-account tokens, exposing email, files, and calendars in researchers' tests. Microsoft says exploitation requires a user to complete a sign-in flow and reports no known attacks. The fix is available in version 6.2606.4246 and later.