Loading story…
Microsoft said the China-aligned espionage group Storm-0558 stole a Microsoft consumer signing key and used it to forge authentication tokens that granted unauthorized access to Exchange Online and Outlook.com mailboxes. The company said the activity began in May and affected email accounts at 25 organizations as well as related consumer accounts, prompting mitigation and a broader investigation into how the actor obtained and abused the key to access cloud-hosted email.
Subsequent analysis indicated the impact may have extended beyond email. Researchers reported the compromised key could potentially authenticate access to additional Microsoft services, including Azure Active Directory, SharePoint, Teams, and OneDrive, as well as some customer-managed applications relying on Microsoft authentication. SecurityScorecard later identified 10 IP addresses in NetFlow data that may have served as attacker proxies linked to the campaign, and said the traffic suggested possible targeting of Microsoft and a Western European government ministry, although the full victim scope remained unconfirmed.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
On July 14, 2023, Microsoft published a technical analysis of Storm-0558's techniques for unauthorized email access. The company described the actor's use of SoftEther VPN, dedicated servers, TOR or SOCKS5 proxies, and released indicators of compromise including IP addresses and usage timeframes.
On July 11, 2023, Microsoft disclosed that a threat actor had obtained a Microsoft private encryption key and used forged tokens to access customer Exchange Online and Outlook.com accounts. Microsoft attributed the campaign to Storm-0558 and said it affected email accounts at 25 organizations plus related consumer accounts.
Microsoft said the observed Storm-0558 activity began on May 15, 2023. The campaign used a stolen Microsoft private encryption key to forge tokens and access Exchange Online and Outlook.com accounts.
SecurityScorecard analyzed partner traffic data, public reporting, and NetFlow and identified ten IP addresses that may have been used as proxies to communicate with dedicated servers tied to the Storm-0558 campaign. It also observed traffic that could suggest targeting of Microsoft and a Western European government ministry, while noting the evidence was not conclusive.
Subsequent reporting found that the compromised Microsoft key may have enabled access beyond Exchange Online and Outlook.com, including Azure Active Directory, SharePoint, Teams, OneDrive, and customer-managed applications using Microsoft authentication. This suggested the compromise may have affected more organizations than the 25 Microsoft originally estimated.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 10 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
securityscorecard.com
Open sourcewiz.io
Open sourcemicrosoft.com
Open sourceblogs.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A U.S. Cyber Safety Review Board report sharply criticized Microsoft’s response to the **Storm-0558** intrusion that let China-linked attackers access Exchange Online mailboxes by forging authentication tokens with a stolen **Microsoft consumer signing key**. The campaign began in mid-May 2023 and affected more than **500 individuals across 22 organizations**, including senior U.S. government officials; attackers reportedly stole about **60,000 unclassified emails** from the U.S. Department of State over at least six weeks. The board said Microsoft still could not definitively explain how the key was obtained, despite earlier statements that tied the theft to crash dumps and a compromised engineer account associated with a prior 2021 intrusion. The review said Microsoft’s security failures worsened the breach, including retaining a **2016 signing key** that should have been revoked in 2021, relying on manual key rotation, and allowing an **OIDC/SDK token validation flaw** that let a consumer key sign tokens accepted for enterprise email accounts. The incident also exposed major visibility gaps because some customers lacked access to the logs needed to detect the intrusion; in response, Microsoft and **CISA** expanded access to critical logging, and Microsoft later extended default audit log retention while continuing its technical investigation into the key acquisition.
Sep 3, 2026
Microsoft reported that **Storm-2949** used social engineering and abuse of Microsoft **Self-Service Password Reset (SSPR)** to compromise multiple **Microsoft Entra ID** accounts, including accounts tied to IT staff and senior leadership, then expanded access across **Microsoft 365** and **Azure**. After the initial identity takeover, the actor conducted tenant discovery through the **Microsoft Graph API**, exfiltrated data from **OneDrive** and **SharePoint**, and sought persistence by re-registering MFA methods and attempting to abuse service principal credentials. The intrusion then moved deeper into Azure, where Storm-2949 relied on legitimate management-plane operations and privileged **Azure RBAC** roles to access **App Services**, **Key Vault**, **SQL databases**, **Storage accounts**, and **virtual machines**. Microsoft said the actor used publish profiles, Key Vault permission changes, SQL firewall rule modifications, storage key listing, **VMAccess**, and **Run Command** to harvest credentials, execute code, deploy **ScreenConnect** on VMs, weaken Microsoft Defender Antivirus, and exfiltrate large volumes of data while blending into normal administrative activity; the group also cleared event logs and deleted artifacts to hinder detection.
Jun 29, 2026
Microsoft disclosed a large-scale phishing campaign that targeted more than **35,000 users** at over **13,000 organizations** across **26 countries**, with most victims in the United States and concentrations in healthcare, life sciences, financial services, professional services, and technology. The operation used code-of-conduct and compliance-themed emails delivered through legitimate email services, including abuse of platforms such as Amazon SES, to make messages appear trustworthy and help them pass common email authentication checks. Victims received PDF attachments containing links that led through fake CAPTCHA and document-review pages before landing on spoofed Microsoft sign-in portals. Microsoft said the attackers used an **adversary-in-the-middle** phishing flow to capture credentials and authentication tokens in real time, allowing them to bypass weak multifactor authentication and gain immediate account access. The company described the activity as one of the most sophisticated code-of-conduct-themed credential theft campaigns it has observed and said it reflects broader trends including CAPTCHA-gated phishing, QR-code phishing, and phishing-as-a-service ecosystems such as **Tycoon 2FA**, **Kratos**, and **EvilTokens**. Microsoft urged organizations to strengthen defenses with Defender for Office 365, SmartScreen-enabled browsers, phishing awareness training, stronger authentication, conditional access policies, and automated attack disruption in Defender XDR.
Jun 29, 2026