Token Forgery
Security incidents tagged Token Forgery. Newest first.
0 Token Forgery incidents in the last 12 months
Critical 4 · High 3 · Med 2 · Low 1 · Update ½Severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½LessMore
- Incidents
- 1
- Live
- 0
- Patched
- 1
- Days without an incident
- 1142
- Longest quiet run: 1142 days (Sep 7–Oct 22)
Show 1 older incident1 older incident
May 2023 1
- CriticalPatched
Storm-0558: stolen Microsoft signing key used to read government email
China-based Storm-0558 used a stolen Microsoft consumer (MSA) signing key, plus a token validation bug, to forge tokens and read Exchange Online and Outlook.com mail at about 25 organisations, including US government agencies. Microsoft later said the key leaked through a 2021 crash dump.
Microsoft Exchange Online / Outlook.com (Azure AD and MSA token signing)Closed Sep 6, 2023
