“The old public key’s certificate revealed it was issued on April 5th, 2016, and expired on April 4th, 2021, and its thumbprint matched the thumbprint of the key Microsoft listed in their latest blog post, named “Thumbprint of acquired signing key””
The key China’s Storm-0558 stole expired in April 2021 and stayed on Microsoft’s trusted list until mid-2023. Microsoft said only Outlook.com and Exchange Online were hit. Wiz says the same key could forge tokens for SharePoint, Teams, OneDrive and any app with “login with Microsoft.” Customers lack the logs to tell whether forged tokens were used against them, so Microsoft’s narrow answer is one nobody can check.