# Storm-0558: stolen Microsoft signing key used to read government email · pwn.watch

> China-based Storm-0558 used a stolen Microsoft consumer (MSA) signing key, plus a token validation bug, to forge tokens and read Exchange Online and Outlook.com mail at about 25 organisations, including US government agencies. Microsoft later said the key leaked through a 2021 crash dump.

Page: https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023 · generated 2026-10-22T21:47:37.879Z

## Status
- Severity: critical · status: closed · patch: patched
- Product: Microsoft Exchange Online / Outlook.com (Azure AD and MSA token signing)
- Started: 2023-05-15 · closed: 2023-09-06

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023/feed.xml
- JSON Feed: https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023.json
- This file: https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023/llms.txt

## Updates (newest first)
- 2023-09-06: Microsoft: the key most likely leaked via a 2021 crash dump that reached its corporate network (https://msrc.microsoft.com/blog/2023/09/results-of-major-technical-investigations-for-storm-0558-key-acquisition/)
- 2023-07-14: Microsoft details how the stolen MSA key was used to forge tokens (https://www.microsoft.com/en-us/security/blog/2023/07/14/analysis-of-storm-0558-techniques-for-unauthorized-email-access/)
- 2023-07-11: Microsoft discloses the intrusion; CISA and FBI publish AA23-193A (https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-193a)
- 2023-06-16: Microsoft opens an investigation after a customer reports anomalous mail access (https://msrc.microsoft.com/blog/2023/07/microsoft-mitigates-china-based-threat-actor-storm-0558-targeting-of-customer-email/)
- 2023-05-15: Storm-0558 begins accessing customer email with forged tokens (https://msrc.microsoft.com/blog/2023/07/microsoft-mitigates-china-based-threat-actor-storm-0558-targeting-of-customer-email/)

## Fix brief
# Security brief: Storm-0558: stolen Microsoft signing key used to read government email

Source: https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023 · status: closed (closed Sep 6, 2023) · severity: critical · updated Sep 6, 2023

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
China-based Storm-0558 used a stolen Microsoft consumer (MSA) signing key, plus a token validation bug, to forge tokens and read Exchange Online and Outlook.com mail at about 25 organisations, including US government agencies. Microsoft later said the key leaked through a 2021 crash dump.

Severity detail: Cloud identity compromise of a hyperscaler signing key

- Product: Microsoft Exchange Online / Outlook.com (Azure AD and MSA token signing)

## Affected versions
- Not specified in the data. Check the advisories below.

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
No fixed version is listed. Follow the vendor advisory below.

## Secrets to rotate
This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs.

## Latest updates
- Sep 6, 2023: Microsoft: the key most likely leaked via a 2021 crash dump that reached its corporate network
- Jul 14, 2023: Microsoft details how the stolen MSA key was used to forge tokens
- Jul 11, 2023: Microsoft discloses the intrusion; CISA and FBI publish AA23-193A
- Jun 16, 2023: Microsoft opens an investigation after a customer reports anomalous mail access
- May 15, 2023: Storm-0558 begins accessing customer email with forged tokens

## Advisories
- [Microsoft mitigates China-based threat actor Storm-0558 targeting of customer email](https://msrc.microsoft.com/blog/2023/07/microsoft-mitigates-china-based-threat-actor-storm-0558-targeting-of-customer-email/) (Microsoft)
- [Results of Major Technical Investigations for Storm-0558 Key Acquisition](https://msrc.microsoft.com/blog/2023/09/results-of-major-technical-investigations-for-storm-0558-key-acquisition/) (Microsoft)
- [Enhanced Monitoring to Detect APT Activity Targeting Outlook Online (AA23-193A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-193a) (CISA)

## Write-ups & news
- [Analysis of Storm-0558 techniques for unauthorized email access](https://www.microsoft.com/en-us/security/blog/2023/07/14/analysis-of-storm-0558-techniques-for-unauthorized-email-access/)

---
Machine-readable: https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.