# Microsoft's Android App Misconfiguration Leaves Millions of 365 Users Vulnerable to Account Takeover


A disabled security setting in Microsoft 365's Android applications has created a widespread vulnerability allowing attackers to intercept and steal user credentials, potentially exposing millions of organizational accounts to unauthorized access. The oversight, discovered in mobile versions of Word, PowerPoint, Excel, and other critical apps, highlights how fundamental authentication protections can be inadvertently disabled through seemingly minor coding decisions.


## The Threat


Security researchers have identified that a critical authentication security feature was disabled across Microsoft 365's Android application suite, creating a direct pathway for attackers to perform man-in-the-middle (MITM) attacks and credential theft. The vulnerability allows threat actors on the same network or positioned to intercept network traffic to:


  • Intercept authentication tokens without detection
  • Steal user credentials during login or app initialization
  • Hijack active sessions to gain unauthorized access to Office documents, email, and collaboration tools
  • Exfiltrate sensitive data from organizational accounts
  • Maintain persistent access through stolen credentials

    • The vulnerability affects users connecting through public Wi-Fi networks, compromised corporate networks, or any scenario where an attacker can position themselves to observe or manipulate network traffic. Given that Microsoft 365 is ubiquitous in enterprise environments, the potential exposure encompasses millions of users across organizations worldwide.


    ## Background and Context


    Microsoft 365 mobile applications have become essential tools for remote and hybrid workforces, allowing employees to create, edit, and collaborate on documents from Android devices. These applications handle some of the most sensitive corporate information—from financial spreadsheets to strategic presentations and confidential communications.


    Security best practices for mobile applications require multiple layers of authentication protection, particularly for apps that access sensitive data. One critical protection mechanism is certificate pinning, a technique that validates that the server a device is communicating with is legitimate by checking its SSL/TLS certificate against a hardcoded list of known good certificates. This prevents attackers from using fraudulent certificates to impersonate legitimate Microsoft services.


    The vulnerability stems from a coding decision to disable this protective mechanism in the Android versions of Word, PowerPoint, Excel, and related Microsoft 365 applications. This decision appears to have been made without full consideration of the security implications, effectively removing a critical layer of protection that defenders relied upon.


    Timeline of Events:


  • Vulnerability present in Microsoft 365 Android applications for an extended period
  • Vulnerability discovered during security research or internal audit
  • Microsoft acknowledged the issue and began developing patches
  • Initial advisory released to organization partners and enterprise customers
  • Patches rolled out through standard app update mechanisms

    • ## Technical Details


    ### Certificate Pinning and Its Role


    Certificate pinning is a security technique that significantly raises the bar for attackers attempting to intercept HTTPS traffic. Rather than relying solely on the global certificate authority system (which has been compromised before), pinning works by:


    1. Embedding certificate hashes into the application code at development time

    2. Validating server certificates against this hardcoded list during connection establishment

    3. Refusing connections from servers using valid but unpinned certificates

    4. Preventing MITM attacks even from threat actors with the ability to obtain legitimate certificates


    By disabling certificate pinning in the Android applications, Microsoft inadvertently removed this protections, reverting to standard HTTPS validation that relies solely on the certificate authority system.


    ### Attack Scenario


    An attacker could exploit this vulnerability through a relatively straightforward process:


    | Attack Step | Method |

    |---|---|

    | Network Positioning | Compromised router, malicious Wi-Fi network (evil twin), ISP-level access, or compromised network segment |

    | Traffic Interception | Use tools like mitmproxy or Burp Suite to intercept HTTPS traffic |

    | Certificate Substitution | Present a fraudulent certificate that would normally be rejected by certificate pinning |

    | Credential Capture | Record login credentials, authentication tokens, or session cookies |

    | Post-Exploitation | Use stolen credentials to access organizational email, OneDrive, SharePoint, and Teams |


    ### Affected Applications


    The vulnerability impacts:


  • Microsoft Word (Android)
  • Microsoft PowerPoint (Android)
  • Microsoft Excel (Android)
  • Potentially other Microsoft 365 mobile applications

    • Desktop and iOS versions appear unaffected, suggesting this was Android-specific code path vulnerability.


    ## Implications


    ### Enterprise Risk


    Organizations relying on Microsoft 365—which includes the vast majority of mid-to-large enterprises and government agencies—face significant risk. The implications include:


  • Credential compromise of employee accounts with access to sensitive corporate data
  • Lateral movement from compromised user accounts to additional systems and accounts
  • Data exfiltration from email, OneDrive, SharePoint, and Teams
  • Regulatory exposure including potential HIPAA violations for healthcare organizations, GDPR violations for EU-based companies, and industry-specific compliance failures
  • Supply chain risk if attackers use compromised accounts to access vendor or partner networks

    • ### Attack Likelihood


    The technical barrier to exploiting this vulnerability is relatively low. Threat actors with network access—including but not limited to:


  • Nation-state actors conducting espionage campaigns
  • Financially motivated cybercriminals targeting business email compromise (BEC) operations
  • Malicious insiders or employees of network providers
  • Opportunistic attackers operating on compromised corporate networks

    • …can exploit this vulnerability without sophisticated tools or deep technical knowledge. Any attacker capable of performing a basic MITM attack can weaponize this security gap.


    ### Mobile-Specific Concerns


    Android's fragmented ecosystem means that users running older versions may not receive patches, or may receive them months after release. This extends the window of vulnerability for many organizations.


    ## Recommendations


    ### Immediate Actions


    Organizations should take the following steps immediately:


    1. Audit Android Device Usage – Identify which employees use Microsoft 365 applications on Android devices and assess their risk profile

    2. Apply Available Patches – Deploy the latest versions of Word, PowerPoint, Excel, and related applications across all managed Android devices

    3. Network Segmentation – Ensure sensitive corporate networks are properly segmented to limit the impact of compromised credentials

    4. Enhanced Monitoring – Monitor authentication logs for unusual access patterns, impossible travel scenarios, or access from unexpected locations


    ### Medium-Term Strategies


    2. Implement Conditional Access Policies – Use Microsoft 365's Conditional Access to require additional authentication factors for mobile access, particularly from untrusted networks

    3. Deploy Mobile Device Management (MDM) – Use MDM solutions to enforce app versions, monitor app behavior, and remotely wipe compromised devices

    4. Educate Employees – Reinforce that Microsoft 365 apps should not be used on untrusted networks, and that company networks should not be accessed via public Wi-Fi

    5. Review Device Policies – Consider restricting Microsoft 365 access from personal devices or implementing stricter authentication requirements


    ### Long-Term Governance


  • Establish security code review processes to catch disabled security features before release
  • Implement application security testing (SAST/DAST) in the development pipeline
  • Require security sign-off on any changes to authentication or encryption mechanisms
  • Establish incident response procedures for mobile-specific compromises

    • ---


    ## HackWire Analysis


    This vulnerability represents a significant failure in security culture at Microsoft—not a sophisticated zero-day, but a disabled protection mechanism that should have triggered immediate escalation through code review. The "coding gaffe" framing minimizes what appears to be a systematic gap in how security decisions are validated before shipping to millions of mobile users.


    What makes this particularly concerning is the Android-specific nature of the vulnerability. It suggests that Microsoft may be applying different security standards across platforms, or that Android development teams lacked the same security review rigor as desktop teams. This is a pattern we've seen repeatedly: mobile apps receive less scrutiny because they're perceived as lower-risk, even when they handle sensitive authentication credentials.


    The timing matters here too. We're seeing an acceleration in targeted mobile compromise campaigns, with threat actors increasingly recognizing that mobile devices represent attractive targets for account takeover. With this vulnerability in the wild, expect to see rapid weaponization—particularly against enterprise targets where the ROI for compromised employee credentials is highest.


    For defenders: this is a stark reminder that no amount of endpoint detection or network monitoring compensates for disabled authentication protections. If your security posture relies on users connecting to corporate services from corporate-issued devices without network-level protections, you have a problem. Implement conditional access policies that make compromised Android credentials significantly less useful. If you haven't audited whether your mobile app deployment includes enabled certificate pinning across all your authentication paths, start there.


    — *HackWire Editorial*


    ---


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)