MICROSOFT AUTHENTICATOR FLAW LETS MALICIOUS ANDROID APPS STEAL ACCOUNT TOKENS WITH ZERO PERMISSIONS

Summary from the TLDR InfoSec newsletter

Microsoft released an update to its Authenticator for Android app that could enable a local privilege escalation attack. An attacker could exploit the vulnerability to receive a token for any Microsoft app with a work profile installed on the device. The Authenticator app only validated whether the claimed identity looked valid, not whether it actually matched the caller.