{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T22:28:51.438Z",
  "tag": {
    "id": "token-forgery",
    "label": "Token Forgery",
    "isStack": false,
    "url": "https://pwn.watch/t/token-forgery",
    "feed": "https://pwn.watch/t/token-forgery/feed.xml"
  },
  "counts": {
    "incidents": 1,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 1
  },
  "incidents": [
    {
      "slug": "microsoft-storm-0558-forged-tokens-exchange-online-2023",
      "title": "Storm-0558: stolen Microsoft signing key used to read government email",
      "url": "https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023",
      "json": "https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Microsoft Exchange Online / Outlook.com (Azure AD and MSA token signing)",
      "tags": [
        "microsoft",
        "microsoft-365",
        "exchange-online",
        "azure",
        "china",
        "token-forgery",
        "data-breach"
      ],
      "cveIds": [],
      "affectedVersions": [],
      "fixedVersions": [],
      "startedAt": "2023-05-15",
      "closedAt": "2023-09-06",
      "updatedAt": "2023-09-06",
      "summary": "China-based Storm-0558 used a stolen Microsoft consumer (MSA) signing key, plus a token validation bug, to forge tokens and read Exchange Online and Outlook.com mail at about 25 organisations, including US government agencies. Microsoft later said the key leaked through a 2021 crash dump.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "microsoft-storm-0558-forged-tokens-exchange-online-2023",
      "incidentTitle": "Storm-0558: stolen Microsoft signing key used to read government email",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-09-06",
      "title": "Microsoft: the key most likely leaked via a 2021 crash dump that reached its corporate network",
      "body": null,
      "sourceUrl": "https://msrc.microsoft.com/blog/2023/09/results-of-major-technical-investigations-for-storm-0558-key-acquisition/",
      "url": "https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023"
    },
    {
      "incident": "microsoft-storm-0558-forged-tokens-exchange-online-2023",
      "incidentTitle": "Storm-0558: stolen Microsoft signing key used to read government email",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-07-14",
      "title": "Microsoft details how the stolen MSA key was used to forge tokens",
      "body": null,
      "sourceUrl": "https://www.microsoft.com/en-us/security/blog/2023/07/14/analysis-of-storm-0558-techniques-for-unauthorized-email-access/",
      "url": "https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023"
    },
    {
      "incident": "microsoft-storm-0558-forged-tokens-exchange-online-2023",
      "incidentTitle": "Storm-0558: stolen Microsoft signing key used to read government email",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-07-11",
      "title": "Microsoft discloses the intrusion; CISA and FBI publish AA23-193A",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-193a",
      "url": "https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023"
    },
    {
      "incident": "microsoft-storm-0558-forged-tokens-exchange-online-2023",
      "incidentTitle": "Storm-0558: stolen Microsoft signing key used to read government email",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-06-16",
      "title": "Microsoft opens an investigation after a customer reports anomalous mail access",
      "body": null,
      "sourceUrl": "https://msrc.microsoft.com/blog/2023/07/microsoft-mitigates-china-based-threat-actor-storm-0558-targeting-of-customer-email/",
      "url": "https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023"
    },
    {
      "incident": "microsoft-storm-0558-forged-tokens-exchange-online-2023",
      "incidentTitle": "Storm-0558: stolen Microsoft signing key used to read government email",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-05-15",
      "title": "Storm-0558 begins accessing customer email with forged tokens",
      "body": null,
      "sourceUrl": "https://msrc.microsoft.com/blog/2023/07/microsoft-mitigates-china-based-threat-actor-storm-0558-targeting-of-customer-email/",
      "url": "https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023"
    }
  ]
}