Storm-0558 forged token attack

Try it out loud first. Then check yourself:

1. China-linked Storm-0558 obtained a Microsoft consumer (MSA) token-signing key created in 2016 that was never retired
2. A validation flaw let Exchange Online accept consumer-key-signed tokens for enterprise mailboxes: forge, then read mail
3. About 25 organisations hit, incl. US State and Commerce; MFA, passwords and endpoint controls were irrelevant
4. State detected it via MailItemsAccessed audit events in premium logging; Microsoft later added it to standard (E3/G3) audit
5. CSRB (2024) called it a preventable cascade of failures; Microsoft could not confirm how the key was stolen

If the interviewer pushes back

• If you are a cloud tenant, what can you realistically detect or control when the provider's signing key is stolen?
• Compare this with Golden SAML in SolarWinds: who owned the compromised key, and who could rotate it?

Go deeper

• www.cisa.gov/news-events/cybersecurity-advisories/aa23-193a
• attack.mitre.org/techniques/T1606/