# Storm-0558 forges tokens to exfiltrate Exchange Online mail

Published: 2025-07-14 · Severity: routine · Sectors: government-national
Canonical: https://vorant.io/reports/83c77afe-d213-55de-82fc-4f6b2cef5554/storm-0558-forges-tokens-to-exfiltrate-exchange-online-mail

> China-based APT accessed Outlook data via stolen consumer key token-forging; enable MailItemsAccessed audit logging to detect.

In June 2023, a U.S. federal civilian agency discovered suspicious MailItemsAccessed events in Microsoft 365 Audit Logs with unexpected AppIDs, indicating unauthorized access to Exchange Online mailboxes. Microsoft determined that advanced persistent threat actors—identified as Storm-0558, a China-based group—had compromised a Microsoft account (MSA) consumer key and used it to forge authentication tokens impersonating both consumer and enterprise users. The attackers gained access to and exfiltrated unclassified Outlook data from a limited number of accounts across multiple targeted organizations. Microsoft remediated the compromise by blocking tokens issued with the stolen key and replacing it.

The critical detection mechanism was MailItemsAccessed event logging combined with baseline analysis of normal Outlook activity by AppID. CISA and the FBI note this activity would not have been detectable through standard audit logs alone. Organizations are strongly urged to implement enhanced logging, particularly Purview Audit (Premium) at G5/E5 licensing levels and Microsoft 365 Unified Audit Logging (UAL), to establish and monitor baselines for detecting similar token-forging attacks. All remediation actions remain Microsoft's responsibility due to the cloud infrastructure involved, but organizations should harden their environments through baseline security configurations, admin-user separation, comprehensive log aggregation via SIEM, and contractual monitoring obligations with cloud service providers.

## Mentioned in this report

- Threat actors: Storm-0558

## Detection guidance (public sample)

### Exchange Online MailItemsAccessed Events for AppID Baseline Hunting

ATT&CK: T1114.002

Surfaces Exchange Online MailItemsAccessed audit events (Purview Audit Premium/E5 or G5) so mailbox access by unexpected AppIDs can be baselined and flagged, as with Storm-0558 forged-token access. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Exchange Online MailItemsAccessed Events for AppID Baseline Hunting
status: experimental
description: Detects MailItemsAccessed audit events in the Microsoft 365 Unified Audit
  Log. Storm-0558 used forged tokens to read Exchange Online mail and was only noticed
  via MailItemsAccessed events carrying unexpected AppIDs. This is a hunting-grade
  rule with no exclusions. Before alerting on it, baseline the AppId values seen in
  your tenant and alert on first-seen AppIds, or on mail access from AppIds that are
  not normally used by the mailbox owner. Requires Purview Audit (Premium) or equivalent
  licensing so MailItemsAccessed is logged.
tags:
- attack.collection
- attack.t1114.002
- attack.credential-access
- attack.t1528
- attack.t1550.001
logsource:
  product: m365
  service: audit
detection:
  selection:
    eventSource: Exchange
    eventName: MailItemsAccessed
  condition: selection
falsepositives:
- Legitimate mail clients, mobile apps, backup and archiving tools, and eDiscovery
  or compliance products that read mailboxes via Graph or EWS
- Normal OWA and Outlook usage, which generates these events continuously
level: low
id: dc68aec0-f40a-51ef-8268-1af415fab068
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-193a
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-193a

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/83c77afe-d213-55de-82fc-4f6b2cef5554/storm-0558-forges-tokens-to-exfiltrate-exchange-online-mail.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup