# Compromised Microsoft Key: More Impactful Than We Thought

Storm-0558 stole a Microsoft MSA signing key and forged OpenID v2.0 tokens, impersonating users across Outlook, Teams, SharePoint and any app trusting the key.

- Payout: Real-world hack
- Severity: critical
- Program: Microsoft
- Analysis by: Wiz Research
- Disclosed: 2023-07-21
- Write-up quality: 8/10
- Original: https://www.wiz.io/blog/storm-0558-compromised-microsoft-key-enables-authentication-of-countless-micr
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-storm-0558-compromised-microsoft-key-enables-authentication-of-countless-micr
- Tags: area:cloud domain:cloud impact:ato impact:data-leak kind:incident platform:threat-intel sev:critical tech:azure tech:jwt tech:oidc technique:recon technique:source-review vuln:account-takeover vuln:auth-bypass

**Target:** Azure Active Directory OpenID v2.0 token verification / MSA signing key
**Root cause:** A private MSA consumer signing key was acquired by the threat actor and remained trusted in the public key lists used to validate OpenID v2.0 tokens for personal and mixed-audience AAD applications, so tokens signed with it were accepted as genuine.
**Steps:**
1. Enumerate the AAD public key endpoints (common, consumers, tenant-specific discovery/v2.0/keys) to see which keys are trusted for which app audiences.
2. Compare archived copies of the key list via the Wayback Machine; note key `1LTMzakihiRla_8z2BEJVXeWMqo` was replaced between June 27 and July 5, 2023.
3. Decode the old key's x5c certificate; confirm its thumbprint matches Microsoft's published 'Thumbprint of acquired signing key'.
4. Craft a JWT with victim data (e.g. email) in claims, set `iss` to `https://sts.windows.net/9188040d-6c67-4c5b-b112-36a304b66dad/v2.0` and `tid` to `9188040d-6c67-4c5b-b112-36a304b66dad`, and sign it with the compromised private key.
5. Submit the forged token to a target app that validates against the common/consumers key list to authenticate as the victim.
6. Detect abuse by searching application logs for `kid` = `1LTMzakihiRla_8z2BEJVXeWMqo`, MSA tenant `tid`, or the published attacker IPs.
**How found:** Wiz started from Microsoft's disclosure of an acquired MSA key, checked which keys can sign OpenID tokens for MSA and AAD apps, and used the Wayback Machine to spot a long-standing public key replaced in the exact June 27–July 5 window; decoding its certificate and matching the thumbprint to Microsoft's published acquired-key thumbprint confirmed the identity and scope of the compromised key.
**Exploitation:** Storm-0558 signed forged OpenID v2.0 tokens offline with the stolen MSA key, impersonating users to OWA/Outlook.com and issuing valid Exchange Online access tokens; because signing is offline there is no issuance trail in the Azure portal, and prior sessions could be used to establish persistence via application permissions or backdoors.
**Escalation:** The single key was trusted across all personal-account and mixed-audience v2.0 apps (SharePoint, Teams, OneDrive, 'Login with Microsoft' apps), and apps lacking issuer validation could be tricked into accepting MSA-signed tokens for organizational accounts, widening impact far beyond Outlook.
**Insight:** Identity-provider signing keys are cross-tenant master keys: when a key is rotated, diff archived JWKS endpoints to identify the retired key, then check whether apps validate the issuer against the JWKS issuer field — apps that skip that check accept MSA-signed tokens for organizational accounts.

## Proof of concept (copied exactly from the original report)

**Azure CLI command listing potentially affected AAD apps**

```
az ad app list --filter "(signinaudience eq 'AzureADMultipleOrgs' or signinaudience eq 'AzureADandPersonalMicrosoftAccount' or signinaudience eq 'PersonalMicrosoftAccount')" --query "[?id].{AppName:displayName, AppID:appId, ObjID:id, HomePageURL:web.homePageUrl}"
```

**Log Analytics query for attacker IPs**

```
AppServiceHTTPLogs 
| where Result == "Success" 
 and CIp in ("195.26.87.219","185.236.228.183","85.239.63.160","193.105.134.58", 
 "146.0.74.16","91.231.186.226","91.222.174.41","185.38.142.249", 
 "51.89.156.153","176.31.90.129","137.74.181.100","193.36.119.45", 
 "185.158.248.159","131.153.78.188","37.143.130.146","146.70.157.45", 
 "185.195.200.39","185.38.142.229","146.70.121.44","31.42.177.181", 
 "185.51.134.52","173.44.226.70","45.14.227.233","185.236.231.109", 
 "178.73.220.149","45.14.227.212","91.222.173.225","146.70.35.168", 
 "146.70.157.213","31.42.177.201","5.252.176.8","80.85.158.215", 
 "193.149.129.88","5.252.178.68","116.202.251.8")
```

**Public key metadata with compromised kid**

```
{ 
   "kty":"RSA", 
   "use":"sig", 
   "kid":"1LTMzakihiRla_8z2BEJVXeWMqo", 
   "x5t":"1LTMzakihiRla_8z2BEJVXeWMqo", 
   "n":"3sKcJSD4cHwTY5jYm5lNEzqk3wON1CaARO5EoWIQt5u-X-…", 
   "e":"AQAB", 
   "x5c":[ 
"MIIDYDCCAkigAwIBAgIJAIB4jVVJ3BeuMA0GCSqGSIb3DQEBCwUA…" 
   ], 
   "issuer":"https://login.microsoftonline.com/9188040d-6c67-4c5b-b112-36a304b66dad/v2.0"
```