Authenticator checked the app you claimed to be. It never checked who was actually asking
2026-10-31Security
Enclave published AuthMask on 23 October. A zero-permission Android app could say it was Teams and have Microsoft Authenticator hand over the work account's tokens, including the scopes that create and delete passkeys.