We got Microsoft Authenticator to hand over account tokens to a fake Teams app.

The app needed zero Android permissions. It just claimed to be Teams, and Authenticator never checked who was actually asking.

The result: full delegated access to mailbox, files, and calendar through Microsoft Graph.

Full write-up by @ofekdavidlevin with code and PoC: enclave.ai/blog/authmask-we-made-micros…