Microsoft says Storm-0558 forged tokens to access Outlook accounts

Microsoft disclosed that a China-linked group, Storm-0558, forged authentication tokens using a stolen signing key to access email, intensifying scrutiny of token security.