INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Microsoft 365 Account Takeover Exploited via Coding Vulnerability

| 2026-06-03 19:00 MEDIUM HIGH
JSON
Executive Summary AI-generated
The recent incident involving Microsoft 365 accounts being exposed to widespread takeover due to a coding mistake in several Android applications has highlighted the critical need for robust security measures. Researchers at Enclave discovered a vulnerability in debug settings that was left enabled in production releases of multiple apps, including Excel, Word, PowerPoint, OneNote, Loop, and Microsoft 365 Copilot. This allowed attackers to bypass necessary authorization checks and replicate access across affected apps due to the vulnerable code being part of a shared software development kit (SDK). The incident demonstrates how even seemingly secure systems can be compromised if not properly secured against coding mistakes or vulnerabilities in third-party applications.
Technical Mitigations AI-generated
• Disabling the "debug setting" in Microsoft Android apps to prevent exposure of user accounts. • Ensuring that authentication tokens are validated and not reused across multiple applications. • Fixing vulnerabilities in software development kits (SDKs) used by Microsoft 365 applications.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
SparkSparkShai-HuludShai-Hulud CVE-2026-41100CVE-2026-41100 CVE-2026-41102CVE-2026-41102 CVE-2026-42832CVE-2026-42832 CVE-2026-41101CVE-2026-41101
Target & Sectors
Global Scope legallegal
Incident Timeline
‎2026/06/03
Threat actors exploited a coding mistake in multiple Microsoft Android apps, including Excel, Word, PowerPoint, OneNote, Loop, and 365 Copilot, to gain unauthorized access to user accounts.
infrastructure Microsoft 365
Coding Gaffe Exposes Microsoft 365 Accounts to Widespread Takeover.
A coding mistake in several Microsoft 365 Android applications resulted in the exposure of user accounts to compromise at massive scale, demonstrating once again how dropping the ball on securing authentication tokens can undermine an entire trust model.
Researchers at Enclave discovered a vulnerability in a debug setting that was mistakenly left enabled in production releases of multiple Microsoft Android apps, including Excel, Word, PowerPoint, OneNote, Loop, and Microsoft 365 Copilot, according  to a blog post  published Tuesday.
The attacker could then exfiltrate the token, and use it to access resources across other  Microsoft 365 apps .
organisation Microsoft
Coding Gaffe Exposes Microsoft 365 Accounts to Widespread Takeover.
organisation Widespread Takeover
Coding Gaffe Exposes Microsoft 365 Accounts to Widespread Takeover.
infrastructure Android
A coding mistake in several Microsoft 365 Android applications resulted in the exposure of user accounts to compromise at massive scale, demonstrating once again how dropping the ball on securing authentication tokens can undermine an entire trust model.
Researchers at Enclave discovered a vulnerability in a debug setting that was mistakenly left enabled in production releases of multiple Microsoft Android apps, including Excel, Word, PowerPoint, OneNote, Loop, and Microsoft 365 Copilot, according  to a blog post  published Tuesday.
"A test setting was left turned on in six Microsoft apps on Android phones: Word, OneNote, PowerPoint, Excel, Loop and 365 Copilot," Enclave co-founder and chief product officer Yanir Tsarimi explains to Dark Reading.
According to Enclave, not only was the necessary authorization check protecting this exchange of data disabled in the Android apps, but the access to data also could be replicated across multiple Microsoft apps because the vulnerable code was inside a shared Microsoft software development kit (SDK).
With the protection bypassed, any Android app capable of requesting  a token  could potentially obtain Microsoft  authentication  credentials, Tsarimi explains.
All they would have to do is distribute or update an Android app containing a small token-requesting routine that silently requests tokens from an affected Microsoft application.
Related: Malicious Notifications Could Trick Google Gemini Users Cross-Application Insecurity from Auth Tokens According to Enclave, not only was the necessary authorization check protecting this exchange of data disabled in the Android apps, but the access to data also could be replicated across multiple Microsoft apps because the vulnerable code was inside a shared Microsoft software development kit (SDK).
organisation Microsoft Android
Researchers at Enclave discovered a vulnerability in a debug setting that was mistakenly left enabled in production releases of multiple Microsoft Android apps, including Excel, Word, PowerPoint, OneNote, Loop, and Microsoft 365 Copilot, according  to a blog post  published Tuesday.
organisation PowerPoint
Researchers at Enclave discovered a vulnerability in a debug setting that was mistakenly left enabled in production releases of multiple Microsoft Android apps, including Excel, Word, PowerPoint, OneNote, Loop, and Microsoft 365 Copilot, according  to a blog post  published Tuesday.
organisation OneNote
Researchers at Enclave discovered a vulnerability in a debug setting that was mistakenly left enabled in production releases of multiple Microsoft Android apps, including Excel, Word, PowerPoint, OneNote, Loop, and Microsoft 365 Copilot, according  to a blog post  published Tuesday.
organisation Loop
Researchers at Enclave discovered a vulnerability in a debug setting that was mistakenly left enabled in production releases of multiple Microsoft Android apps, including Excel, Word, PowerPoint, OneNote, Loop, and Microsoft 365 Copilot, according  to a blog post  published Tuesday.
organisation Microsoft 365 Copilot
Researchers at Enclave discovered a vulnerability in a debug setting that was mistakenly left enabled in production releases of multiple Microsoft Android apps, including Excel, Word, PowerPoint, OneNote, Loop, and Microsoft 365 Copilot, according  to a blog post  published Tuesday.
organisation SDK
According to Enclave, not only was the necessary authorization check protecting this exchange of data disabled in the Android apps, but the access to data also could be replicated across multiple Microsoft apps because the vulnerable code was inside a shared Microsoft software development kit (SDK).
Related: Malicious Notifications Could Trick Google Gemini Users Cross-Application Insecurity from Auth Tokens According to Enclave, not only was the necessary authorization check protecting this exchange of data disabled in the Android apps, but the access to data also could be replicated across multiple Microsoft apps because the vulnerable code was inside a shared Microsoft software development kit (SDK).
organisation CVE-2026
Enclave responsibly disclosed the issue to Microsoft, which has since issued updates to fix and multiple CVEs for all of the flaws, which are tracked as  CVE-2026-41100 ,  CVE-2026-41101 , and  CVE-2026-41102 , and  CVE-2026-42832 .
organisation Miasma Supply Chain Worm Burrows Into
Related: Miasma Supply Chain Worm Burrows Into 73 Microsoft Repositories Cross-Application Insecurity from Auth Tokens
organisation Broader Security Implications for Clean Coding
Broader Security Implications for Clean Coding The issue, while fixed, demonstrates not just the importance of clean coding, but also how ensuring the security of  authentication tokens  has become absolutely essential across interconnected Web-based applications and systems.
organisation Miracco
Incidents like this, then, highlight the importance of validating how trustworthy an app and device are in combination with the user, Miracco says.
Tactical Metrics
Metrics
infrastructure
‎Microsoft 365
Affected Product
Coding Gaffe Exposes Microsoft 365 Accounts to Widespread Takeover.
A coding mistake in several Microsoft 365 Android applications resulted in the exposure of user accounts to compromise at massive scale, demonstrating once again how dropping the ball on securing authentication tokens can undermine an entire trust model.
Researchers at Enclave discovered a vulnerability in a debug setting that was mistakenly left enabled in production releases of multiple Microsoft Android apps, including Excel, Word, PowerPoint, OneNote, Loop, and Microsoft 365 Copilot, according  to a blog post  published Tuesday.
The attacker could then exfiltrate the token, and use it to access resources across other  Microsoft 365 apps .
Metrics
infrastructure
‎Android
Affected Product
A coding mistake in several Microsoft 365 Android applications resulted in the exposure of user accounts to compromise at massive scale, demonstrating once again how dropping the ball on securing authentication tokens can undermine an entire trust model.
Researchers at Enclave discovered a vulnerability in a debug setting that was mistakenly left enabled in production releases of multiple Microsoft Android apps, including Excel, Word, PowerPoint, OneNote, Loop, and Microsoft 365 Copilot, according  to a blog post  published Tuesday.
"A test setting was left turned on in six Microsoft apps on Android phones: Word, OneNote, PowerPoint, Excel, Loop and 365 Copilot," Enclave co-founder and chief product officer Yanir Tsarimi explains to Dark Reading.
According to Enclave, not only was the necessary authorization check protecting this exchange of data disabled in the Android apps, but the access to data also could be replicated across multiple Microsoft apps because the vulnerable code was inside a shared Microsoft software development kit (SDK).
With the protection bypassed, any Android app capable of requesting  a token  could potentially obtain Microsoft  authentication  credentials, Tsarimi explains.
All they would have to do is distribute or update an Android app containing a small token-requesting routine that silently requests tokens from an affected Microsoft application.
Related: Malicious Notifications Could Trick Google Gemini Users Cross-Application Insecurity from Auth Tokens According to Enclave, not only was the necessary authorization check protecting this exchange of data disabled in the Android apps, but the access to data also could be replicated across multiple Microsoft apps because the vulnerable code was inside a shared Microsoft software development kit (SDK).
Intelligence Sources
Dark Reading 2026-06-03
Dark Reading 2026-06-03