Microsoft Authenticator Ransomware!?

[Rz68tjon]

Just wondering if anyone else has had their Microsoft Authenticator app flag up as ransomware? Never had it happen before so I'm a little concerned.

[shadowwar]

ITs probably a false positive. Can you please post a detection log and/or the file being detected so we can look into this?

 

[Rz68tjon]

Not sure how to give a detection log on Android but the app is com.azure.authenticator

 

It has a longer extension name after the app title, including device path but am unsure if it's safe to post it all here.

 

[shadowwar]

AHH didnt know this was android. moving topic. 

 

[mbam_mtbr]

Hi @Rz68tjon,

A screenshot of the detection would be very helpful.  Also, an Apps Report would be great as well.

To send an Apps Report with Malwarebytes for Android use the following instructions.

1. Open the Malwarebytes for Android app.
2. Tap the Menu icon.
3. Tap Your apps.
4. Tap three lines icon in upper right corner.
5. Tap Send to support

Choose an email app to send Apps Report.

Your email app will open with the Apps Report included.

At this point, it would be very helpful to mention you are submitting via recommendation from the Malwarebytes forum.  This allows our support staff to know where to direct it.

By sending the Apps Report, you will create a ticket in our support system.

Private Message (PM) me the email used and/or the ticket number assigned.

[Rz68tjon]

Here's the screenshot!

Thanks. 

 

[mbam_mtbr]

Hi @Rz68tjon,

Okay.  By chance are you installing from a third-party app store rather than directly from Google PLAY?

This warning is most likely from our advanced ransomware scanner.  Apps that have elevated privileges and that have been installed using side loading (anything installed outside of Google Play) are flagged as potential ransomware.

Installation from outside the Play Store plus elevated privileges are big red flags. Therefore, we warn our customers that a suspicious app was installed that displays ransomware like properties. It’s up to the user to ignore our warnings or not.

Ransomware is particularity dangerous, and this warning gives users the ability to cut it off before it’s too late.

Regardless, we'll make sure to whitelist Microsoft so this won't trigger even if side loaded.

Thanks for reaching out,

[Rz68tjon]

 

Thanks for your swift reply, Nathan.

No, this was a Google Play app installation only, and it was last updated on Jan 10th, which is why I'm concerned about a fresh detection.

 

[mbam_mtbr]

Hi @Rz68tjon,

Go ahead and send me an Apps Report and I can verify it's the legit version of the app.

[JtheK]

Hi,

I also installed the app through the Play store but it is still flagged by Malwarebytes.

Here is a screenshot

Kr,

JtheK

[mbam_mtbr]

Hi @JtheK,

Are you on the most up-to-date version of Malwarebytes for Android?

 

[JtheK]

Hi,

Yes, I am using 3.12.2.126

[mbam_mtbr]

Hi @JtheK,

Could you send an Apps Report?  I like to check the version of Microsoft Authenticator you are using.  I double checked the version on Google Play, and it is not detected.

 

To send an Apps Report with Malwarebytes for Android use the following instructions.

1. Open the Malwarebytes for Android app.
2. Tap the Menu icon.
3. Tap Your apps.
4. Tap three lines icon in upper right corner.
5. Tap Send to support

Choose an email app to send Apps Report.

Your email app will open with the Apps Report included.

At this point, it would be very helpful to mention you are submitting via recommendation from the Malwarebytes forum.  This allows our support staff to know where to direct it.

By sending the Apps Report, you will create a ticket in our support system.

Private Message (PM) me the email used and/or the ticket number assigned.

[coderev]

Hi,

I have the same problem on my partners phone.

Microsoft Authenticator was downloaded from Google Play store and not from any third party site.

Installed Version 6.2302.0790

Also running the latest Malwarebytes version on Android phone.