Microsoft Storm-0558 signing-key theft and US government email access (2023)

Between May and June 2023, the China-based threat actor tracked by Microsoft as Storm-0558 used a stolen Microsoft consumer signing key to forge authentication tokens and read Outlook Web Access email at approximately 25 organisations, including the U.S. State Department, the Department of Commerce, and the U.S. Ambassador to China. The incident — and the long, embarrassing chain of internal control failures that enabled it — became one of the defining cloud-security cases of the decade.

What happened

Storm-0558 obtained a Microsoft Account (MSA) signing key — the kind used to sign tokens for consumer Outlook accounts. They then exploited a flaw in Azure Active Directory's token-validation logic that allowed a consumer key to sign tokens that enterprise (Exchange Online) accounts would accept. Combined, those two facts let the attacker mint authentication tokens for any enterprise email account they targeted.

Microsoft's September 2023 disclosure described how the consumer key had ended up in attacker hands: a crash dump from a signing-system process inadvertently contained the key, the dump moved into Microsoft's corporate debugging environment in violation of policy, the boundary check did not detect it, and Storm-0558 — after compromising a Microsoft engineer's corporate account — was able to reach the debugging environment and most likely exfiltrate the key. Microsoft could not produce direct evidence of the exfiltration step because log retention had expired.

The U.S. State Department reported anomalies to Microsoft on 16 June 2023, kicking off containment. By July, Microsoft had published initial analysis; by September, the technical post-incident review. In April 2024, the U.S. Cyber Safety Review Board (CSRB) issued a sharply critical report calling the incident a "cascade of avoidable errors" — a striking phrase from a government review body.

Impact

• Outlook Web Access mail at approximately 25 organisations read by Storm-0558.
• Confirmed targets included the U.S. State Department, the U.S. Department of Commerce, and the U.S. Ambassador to China.
• A consumer signing key forged tokens valid for enterprise accounts due to a token-validation flaw.
• Log retention prevented direct confirmation of how the key was exfiltrated.
• U.S. CSRB published one of the most critical post-incident reports ever issued of a major cloud provider.

Why it matters

Storm-0558 reset expectations about cloud-provider key custody: a single misplaced consumer-tier signing key, combined with a token-validation bug, enabled state-level espionage at the U.S. State Department. Microsoft's "cascade of errors" framing — and the CSRB's blistering review — became reference points for how the industry now thinks about engineering-process security at hyperscaler scale.