Storm-0558: stolen Microsoft signing key used to read government email

Teaser from the source

China-based Storm-0558 used a stolen Microsoft consumer (MSA) signing key, plus a token validation bug, to forge tokens and read Exchange Online and Outlook.com mail at about 25 organisations, including US government agencies. Microsoft later said the key leaked through a 2021 crash dump.

This is the RSS-feed teaser. Read the full article at the original source.