Storm-0558 forged Microsoft tokens to read Exchange Online mail
A China-based actor Microsoft tracks as Storm-0558 used an acquired Microsoft consumer (MSA) signing key to forge authentication tokens, and a token validation flaw let those consumer-signed tokens be accepted for enterprise Exchange Online and Outlook.com mailboxes. Access began around May 15, 2023 and was detected by the US State Department through its audit logs in June. Microsoft disclosed on July 11, 2023; the CSRB review found Microsoft never established how the key was stolen.
- Victim
- Microsoft and about 25 customer organizations, including US government agencies
- Industry
- Technology
- Country
- United States
- Intrusion began
- May 15, 2023
- First disclosed
- Jul 11, 2023
- Actor
- Storm-0558 (Nation-state)
- Initial access
- Identity infrastructure vulnerability
- Identity control that failed
- Directory and trust
- MFA
- Not applicable (no interactive login)
- Abused identity
- Human account
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
A single signing key is the root of trust for every token it signs. Hardware-protected keys with enforced rotation, strict issuer and audience validation, and audit logs available to every customer were the controls the CSRB found missing.
Regulatory and legal outcome
Cyber Safety Review Board review, released April 2024, concluded the intrusion was preventable and resulted from a cascade of Microsoft security failures.
Go deeper on SWI
- Product involved: Microsoft Entra ID
Sources
- Analysis of Storm-0558 techniques for unauthorized email access, Microsoft Threat Intelligence, Jul 14, 2023
- Results of major technical investigations for Storm-0558 key acquisition, Microsoft Security Response Center, Sep 6, 2023
- CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion, CISA / Cyber Safety Review Board, Apr 2, 2024
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- FortiCloud SSO bypass hits FortiGates already patched for CVE-2025-59718 2026 · Identity infrastructure vulnerability
- FortiGate FortiCloud SSO SAML bypass used for admin logins and config theft 2025 · Identity infrastructure vulnerability
- BeyondTrust Remote Support zero-day used to dump the appliance credential vault 2026 · Identity infrastructure vulnerability
- N-able N-central authentication bypass used to reach managed customer networks 2026 · Identity infrastructure vulnerability
Cite this record
SWI Community Team. (2026). Storm-0558 forged Microsoft tokens to read Exchange Online mail. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2023-storm-0558-microsoft-signing-key-forgery/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.