Storm-0558, a cyberespionage group affiliated with the People’s Republic of China, has reportedly compromised Microsoft Exchange mailboxes of 22 organizations and over 500 individuals between May and June 2023. This was done by using authentication tokens of accounts that were signed by a Key held by Microsoft in 2016.  This key was used for secure authentication into remote systems.

Source: GBHackers