Compromised Microsoft Key: More Impactful Than We Thought

This report examines the Storm-0558 incident in which a nation-state-linked actor acquired a Microsoft consumer identity signing private key (MSA), enabling offline forging of OpenID v2.0 tokens to impersonate users across Outlook/Exchange and potentially millions of Azure AD v2.0 applications; it describes the affected application types, forensic detection methods (including the compromised key kid and published IP IOCs), risks from cached/trusted keys and persistence, and recommends mitigations such as revoking keys, updating Azure SDKs, refreshing local certificate caches, and reviewing application logs for forged tokens.