Authenticator Cross-App Exploit

Exploits the intent:// handler in WebviewCard to pivot from bet365 Sports App to the Authenticator app. The Authenticator's AppDelegate parses intent query data as domain|tnt|returnURL — setting the attacker's domain as the authentication target.

Step 1: Verify Bridge & Escalate

Step 2: Launch Authenticator with Attacker Domain

How this works
The Authenticator's AppDelegate.resolveLaunchMethod() parses the intent data query string:
domain|tnt|returnURL

It sets Payload.Instance.domain = values[0] (attacker controlled).
When the auth flow completes, encryptPayload() sends GPS coordinates, device UQID, and session tokens to the specified domain.

This opens the Authenticator with your domain set as the auth target. The encrypted payload (GPS, UQID, tokens) will be sent to your server when the auth flow completes.

Step 3: Trigger Authentication Deep Links

These trigger the Authenticator's standard deep link paths. The Authenticator processes the URL and may start location services + auth flow.

Direct Launch (No Payload Injection)

Opens the Authenticator normally. It will start location monitoring as part of its standard initialization. The LocationService is exported=true with no permission.

Other Cross-App Targets