Microsoft Authenticator Handed Over Work Tokens to a Zero-Permission App

A malicious Android app with no permissions, no kernel exploit, and no user interaction beyond installation could silently obtain access tokens, refresh tokens, and ID tokens for the victim's Microsof