Outlook Breach: Microsoft Reveals How a Crash Dump Led to a Major Security Breach

Microsoft on Wednesday revealed that a China-based threat actor known as Storm-0558 acquired the inactive consumer signing key to forging tokens to access Outlook by compromising an engineer’s corporate account.
This enabled the adversary to access a debugging environment that contained a crash dump of the consumer signing system that took place in April 2021 and steal the key.
“A consumer

access account actor adversary breach china consumer corporate crash debugging engineer environment key led major microsoft outlook security security breach signing signing key storm storm-0558 threat threat actor tokens