Microsoft Authenticator could leak login codes—update your app now