Microsoft disrupted Fox Tempest’s MSaaS using 72-hour certificates, cutting signed malware delivery worldwide.

YouTube video by MSNBC

  Microsoft has announced the disruption of a large-scale malware-signing-as-a-service (MSaaS) operation that exploited its Azure Artifact Signing platform to generate fraudulent code-signing certificates. The operation enabled cybercriminals and ransomware groups to disguise malicious software as trusted applications, increasing the likelihood of successful infections. According to a new report from Microsoft Threat Intelligence, the operation was run by a threat actor known as Fox Tempest. The group allegedly abused Microsoft's Artifact Signing service to create short-lived digital certificates that allowed malware to appear legitimate to both users and operating systems. Azure Artifact Signing, formerly known as Trusted Signing, was introduced by Microsoft in 2024 as a cloud-based solution that helps developers digitally sign software through Microsoft's infrastructure. Investigators found that Fox Tempest leveraged the platform extensively, creating over 1,000 certificates along with hundreds of Azure tenants and subscriptions to facilitate its activities. Microsoft has also revealed that it has initiated legal action against the cybercrime operation in the U.S. District Court for the Southern District of New York. "Fox Tempest has created over a thousand certificates and established hundreds of Azure tenants and subscriptions to support its operations. Microsoft has revoked over one thousand code signing certificates attributed to Fox Tempest," Microsoft said. "May 2026, Microsoft's Digital Crimes Unit (DCU), with support from industry partners, disrupted Fox Tempest's MSaaS offering, targeting the infrastructure and access model that enables its broader criminal use." As part of the takedown effort, Microsoft seized the domain signspace[.]cloud, which was used to operate the service. The company also shut down hundreds of virtual machines linked to the operation and blocked access to infrastructure supporting the platform. Visitors attempting to access the domain are now redirected to a Microsoft-controlled page detailing the seizure and ongoing legal proceedings. The investigation connected the service to several malware and ransomware campaigns involving Oyster, Lumma Stealer, Vidar, and ransomware families including Rhysida, Akira, INC, Qilin, and BlackByte. Microsoft stated that threat groups such as Vanilla Tempest, Storm-0501, Storm-2561, and Storm-0249 utilized malware signed through the service. Vanilla Tempest, associated with INC Ransomware, has also been identified as a co-conspirator in Microsoft's legal complaint. The company alleges that the group used the signing platform to distribute malware and ransomware against organizations globally. Researchers found that the malware-signing operation enabled customers to upload malicious files and receive code-signed versions using fraudulently acquired certificates. The signed files often impersonated trusted software brands such as Microsoft Teams, AnyDesk, PuTTY, and Webex, making them appear more credible to potential victims. "When unsuspecting victims executed the falsely named Microsoft Teams installer files, those files delivered a malicious loader, which in turn installed the fraudulently signed Oyster malware and ultimately deployed Rhysida ransomware," reads Microsoft's complaint. "Because the Oyster malware was signed by a certificate from Microsoft's Artifact Signing service, the Windows operating system initially recognized the malware as legitimate software, when it would otherwise be flagged as suspicious or blocked entirely by security controls in the Windows operating system." Microsoft believes the operators likely relied on stolen identities from individuals in the United States and Canada to bypass identity verification requirements and obtain signing credentials. The group reportedly favored certificates with a validity period of just 72 hours, reducing the chances of detection before the certificates expired. The company noted that similar abuse of Microsoft's signing services had previously been observed in malware campaigns involving the Crazy Evil Traffers cryptocurrency theft operation and Lumma Stealer. However, it remains unclear whether those incidents were directly linked to Fox Tempest. Further analysis revealed that Fox Tempest expanded its offerings earlier this year by providing customers with pre-configured virtual machines hosted through Cloudzy infrastructure. Users could upload malware to these systems and receive digitally signed binaries generated through certificates controlled by the group. The service was reportedly promoted through a Telegram channel called "EV Certs for Sale by SamCodeSign." Access to the platform was advertised at prices ranging from $5,000 to $9,000 in Bitcoin. Microsoft estimates that the criminal enterprise generated millions of dollars in revenue. The company described Fox Tempest as a sophisticated and well-funded operation capable of maintaining extensive infrastructure, handling customer support, and processing financial transactions while facilitating cybercrime activities worldwide.

YouTube video by MSNBC

A Microsoft anunciou a desarticulação de uma operação criminosa de assinatura de malware como serviço (MSaaS, na sigla em inglês). O grupo Fox Tempest explorava o sistema Artifact Signing da própria Microsoft para gerar certificados digitais fraudulentos. Isso permitia que cibercriminosos disfarçassem ransomware e outros malwares como software legítimo. A operação atingiu milhares de máquinas e redes em todo o mundo, considerando que o Fox Tempest estava ativo desde maio de 2025. A ação da Microsoft, batizada de OpFauxSign, apreendeu o site “signspace[.]cloud”, usado pelo grupo, além de desativar centenas de máquinas virtuais que sustentavam a operação. O acesso a um repositório no GitHub que hospedava o código da infraestrutura também foi bloqueado. Página de login do serviço criminoso tinha design minimalista. Clientes acessavam o portal após pagamento e entrada na fila de espera. Imagem: Microsoft. ## Como funcionava o esquema O Fox Tempest vendia a capacidade de criar assinaturas digitais fraudulentas para outros criminosos. Basicamente, o serviço permitia que malwares passassem por software confiável aos olhos de sistemas de segurança. O grupo explorava o Artifact Signing da Microsoft, sistema projetado para verificar que um software é legítimo e não foi adulterado. O Fox Tempest conseguia gerar certificados de curta duração, válidos por apenas 72 horas. Para obter os certificados, o grupo precisava passar por processos rigorosos de validação de identidade. A Microsoft avalia que o Fox Tempest usou identidades roubadas de pessoas dos Estados Unidos e do Canadá, o que permitiu que o grupo se passasse por entidades legítimas. Interface do portal signspace[.]cloud permitia upload de arquivos maliciosos. Após envio, os clientes recebiam os binários assinados com certificados controlados pelo Fox Tempest. Imagem: Microsoft. O serviço operava através do site signspace[.]cloud. Clientes criminosos podiam fazer upload de arquivos maliciosos para serem assinados usando certificados controlados pelo Fox Tempest. O malware então se disfarçava como programas conhecidos como AnyDesk, Microsoft Teams, PuTTY e Cisco Webex. ## Preços e modelo de negócio O serviço custava entre US$ 5 mil e US$ 9 mil, cerca de 25 mil a 45 mil reais em conversão direta. Criminosos preenchiam um formulário no Google Forms, escrito em inglês e russo, para escolher um plano – quem pagava mais recebia prioridade na fila de acesso. O Fox Tempest também mantinha um canal no Telegram chamado "EV Certs for Sale by SamCodeSign". O usuário responsável era arbadakarba2000. Ali o grupo se comunicava diretamente com clientes. A Microsoft revogou mais de mil certificados atribuídos ao Fox Tempest, mesmo assim, o grupo continuou se adaptando. Tela de conexão remota à máquina virtual fornecida pelo Fox Tempest. Aviso de segurança indica que o certificado não é de autoridade confiável, mas criminosos ignoravam o alerta. Imagem: Microsoft. ## Mudança para máquinas virtuais Em fevereiro de 2026, o Fox Tempest mudou a estratégia operacional. O grupo começou a fornecer máquinas virtuais pré-configuradas hospedadas na Cloudzy, um provedor americano de servidores virtuais. Os criminosos faziam upload dos arquivos maliciosos diretamente nos ambientes controlados pelo Fox Tempest, e em seguida, recebiam de volta os binários assinados. Isso reduziu o atrito para clientes e melhorou a segurança operacional do grupo. Formulário em russo e inglês exibia três planos de pagamento para o serviço criminoso. Valores variavam entre 5 mil e 9,5 mil dólares, com prioridade na fila para quem pagasse mais. Imagem: Microsoft. Dentro das VMs, o Fox Tempest fornecia arquivos necessários para a assinatura. Um deles era o “metadata.json”, que apontava para um endpoint hospedado no Azure. Outro era um script PowerShell usado para assinar os arquivos dos clientes. ## Conexão com ransomware Rhysida O serviço habilitou a distribuição do ransomware Rhysida por grupos como o Vanilla Tempest, que começou a usar o MSaaS do Fox Tempest em junho de 2025. O Vanilla Tempest distribuía instaladores falsos do Microsoft Teams assinados pelo Fox Tempest, com os arquivos sendo espalhados através de anúncios legítimos comprados pelo grupo. Usuários que buscavam o Microsoft Teams eram redirecionados para páginas de download fraudulentas. Canal no Telegram usado pelo Fox Tempest para divulgar o serviço de certificados digitais fraudulentos. O perfil tinha 290 assinantes e operava sob o nome "EV Certs for Sale by SamCodeSign". Imagem: Microsoft. As vítimas baixavam um arquivo “MSTeamsSetup.exe” malicioso. A execução resultava na instalação do backdoor Oyster, também chamado Broomstick. Esse malware estabelece acesso remoto persistente e permite a entrega de payloads adicionais. Em alguns casos, o Vanilla Tempest também instalou o ransomware Rhysida. ## Outros malwares e alvos A Microsoft identificou que o Fox Tempest habilitou a distribuição de outros malwares, incluindo o Lumma Stealer e o Vidar. A empresa também encontrou ligações do grupo com afiliados de várias famílias de ransomware como INC, Qilin, Akira e BlackByte. Os ataques atingiram setores de saúde, educação, governo e serviços financeiros nos Estados Unidos, França, Índia e China. Diagrama mostra cadeia de ataque combinando Fox Tempest e Vanilla Tempest. O esquema parte da criação de tenant Azure fraudulento até a instalação do ransomware Rhysida através de instalador falso do Microsoft Teams. Imagem: Microsoft. Análises de criptomoedas associadas ao Fox Tempest mostram lucros na casa dos milhões. A Microsoft avalia que o grupo é bem estruturado porque gerencia criação de infraestrutura, relacionamento com clientes e transações financeiras. A Microsoft informou que o Fox Tempest continua tentando se adaptar. O grupo busca migrar operações e clientes para outro serviço de assinatura de código. A empresa afirmou que vai manter a pressão sobre o grupo e parceiros do setor. Acompanhe o TecMundo nas redes sociais. Inscreva-se em nossa newsletter e canal do YouTube.

YouTube video by MSNBC

YouTube video by MSNBC

A financially motivated threat actor known as Fox Tempest has been operating a sophisticated malware-signing-as-a-service (MSaaS) platform that abused Microsoft’s Artifact Signing infrastructure to generate trusted digital signatures for malicious code. This activity enabled cybercriminals to bypass security controls and distribute malware that appeared to be legitimately signed. In May 2026, Microsoft’s Digital Crimes Unit (DCU), in collaboration with Resecurity, disrupted the group’s infrastructure, revoking more than 1,000 fraudulent certificates linked to the operation. Abuse of Microsoft Artifact Signing Fox Tempest leveraged Microsoft’s Artifact Signing service (formerly Azure Trusted Signing) to obtain short-lived code-signing certificates valid for up to 72 hours. These certificates enabled attackers to sign malware binaries so they appeared as trusted applications, including spoofed versions of popular software such as Microsoft Teams, AnyDesk, PuTTY, and Webex. To obtain these certificates, the threat actor likely used stolen or synthetic identities from the United States and Canada to pass Microsoft’s identity verification checks. The operation was facilitated through a now-defunct platform, signspace[.]cloud, which provided a user interface that allowed customers to upload malicious files and receive digitally signed binaries. Microsoft Threat Intelligence has tracked Fox Tempest since September 2025, identifying it as a key enabler within the ransomware ecosystem rather than a direct attacker. Accessing VM provided by Fox Tempest (source: Microsoft) The group created hundreds of Azure tenants and subscriptions to support its operations and issued thousands of certificates at scale. In early 2026, Fox Tempest evolved its infrastructure by offering pre-configured virtual machines (VMs) hosted on third-party providers. These VMs enabled customers to upload payloads directly into controlled environments, where automated scripts and configuration files (e.g., metadata.json and PowerShell scripts) were used to efficiently sign malware. This shift improved operational security and streamlined the signing process. Vanilla Tempest and Fox Tempest attack chain (source :microsoft) Fox Tempest’s MSaaS platform has been linked to multiple high-profile threat actors and ransomware families. Groups such as Vanilla Tempest , Storm-0501, Storm-2561, and Storm-0249 used Fox Tempest-signed malware in real-world intrusions. Associated malware includes Rhysida ransomware, Lumma Stealer, Vidar infostealer, and the Oyster (Broomstick) backdoor. One observed attack chain involved trojanized Microsoft Teams installers distributed via malvertising. Victims downloading the fake installer executed a signed binary that deployed the Oyster backdoor, enabling persistence, command-and-control (C2) communication, and eventual ransomware deployment.  Google form used by Fox Tempest (source :microsoft ) Cryptocurrency analysis indicates that Fox Tempest is closely tied to ransomware affiliates behind families such as Qilin, Akira, and INC, with revenues reaching millions of dollars. Fox Tempest operated as a commercial service, charging cybercriminals between $5,000 and $9,000 for malware-signing services. Access was managed through Telegram channels and online forms, with higher-paying customers receiving priority. Telegram used by Fox Tempest (source : Microsoft) The service lowered the barrier to entry for less sophisticated threat actors by providing trusted code-signing capabilities on demand. Indicators of Compromise (IOCs) Indicators of Compromise (IOCs) linked to Fox Tempest activity include the domain signspace[.]cloud . Investigators also identified the following SHA-1 certificate fingerprints: dc0acb01e3086ea8a9cb144a5f97810d291020ce 7e6d9dac619c04ae1b3c8c0906123e752ed66d63 Additionally, the following SHA-256 file hashes have been associated with the campaign: f0668ce925f36ff7f3359b0ea47e3fa243af13cd6ad9661dfccc9ff79fb4f1cc 11af4566539ad3224e968194c7a9ad7b596460d8f6e423fc62d1ea5fc0724326 Mitigation and Defense Recommendations Microsoft said in a report shared with Cyber Security News that organizations can reduce exposure to signed malware abuse by implementing the following controls: Enable cloud-delivered protection and real-time scanning in endpoint security solutions. Deploy  Microsoft Defender SmartScreen to block malicious downloads and websites. Enforce tamper protection to prevent disabling of security tools. Use attack surface reduction (ASR) rules to block common malware techniques. Enable Safe Links and Safe Attachments in email security solutions. Monitor for suspicious certificate usage and short-lived signing activity. Microsoft’s takedown of Fox Tempest infrastructure marks a significant disruption to the cybercrime supply chain. By targeting the enabling service rather than individual attackers, the operation reduces the ability of multiple ransomware groups to distribute trusted malware at scale. However, the incident highlights how legitimate cloud services and trust mechanisms continue to be abused, reinforcing the need for stronger identity validation and certificate monitoring across the ecosystem. Follow us on  Google News ,  LinkedIn , and  X  to Get More Instant Updates. The post Fox Tempest Malware-Signing Service Abused Microsoft Artifact Signing to Certify Malware appeared first on Cyber Security News .

Microsoft says it has disrupted a malware-signing-as-a-service (MSaaS) operation that abused the company's Artifact Signing service to generate fraudulent code-signing certificates used by ransomware gangs and other cybercriminals.

Microsoft disrupted Fox Tempest, a malware-signing-as-a-service (MSaaS) that allowed attackers to sign malware with fake trusted certificates

Fox Tempest is a financially motivated threat actor operating a malware‑signing‑as‑a‑service (MSaaS) used by other cybercriminals, including Vanilla Tempest and Storm groups, to more effectively distribute malicious code, including ransomware.

YouTube video by MSNBC

Microsoft on Tuesday said it disrupted a malware-signing-as-a-service (MSaaS) operation that weaponized the company's Artifact Signing system to deliver malicious code and conduct ransomware and other...

YouTube video by MSNBC

YouTube video by MSNBC

Microsoft says it has disrupted a malware-signing-as-a-service (MSaaS) operation that abused the company's Artifact Signing service to generate fraudulent code-signing certificates used by ransomware ...

Microsoft and Resecurity disrupted Fox Tempest, a malware-signing service that used fake Microsoft certificates to make malware look legitimate. Resecurity supported Microsoft’s Digital Crimes Unit (DCU) in its disruption of Fox Tempest, a financially motivated threat actor operating a malware-signing-as-a-service (MSaaS) capability used by cybercriminals to make malicious files appear legitimate. On May 19, 2026, […]

Microsoft on Tuesday said it disrupted a malware-signing-as-a-service (MSaaS) operation that weaponized the company's Artifact Signing system to deliver malicious code and conduct ransomware and other attacks, compromising thousands of machines and networks across the world. The tech giant attributed the activity to a threat actor it calls Fox Tempest, which it said offered the MSaaS scheme

Microsoft says it has disrupted a malware-signing-as-a-service (MSaaS) operation that abused the company's Artifact Signing service to generate fraudulent code-signing certificates used by ransomware gangs and other cybercriminals. [...]

Microsoft disrupted Fox Tempest, a malware-signing-as-a-service (MSaaS) that allowed attackers to sign malware with fake trusted certificates. Microsoft said it disrupted a cybercrime operation run by a threat actor named Fox Tempest, which helped threat actors sign malware with short-lived certificates to make malicious software appear legitimate. The service abused Microsoft Artifact Signing and supported […]

Introduction: In May 2026, Microsoft’s Threat Intelligence team exposed and dismantled “Fox Tempest,” a financially motivated malware‑signing‑as‑a‑service (MSaaS) operation that systematically abused Microsoft’s Artifact Signing platform. For nearly a year, Fox Tempest generated over 1,000 short‑lived but valid code‑signing certificates, enabling ransomware affiliates and malware distributors to sign their malicious payloads with legitimate Microsoft‑issued credentials. This attack highlights a dangerous evolution in the cybercrime ecosystem: adversaries no longer need to break security controls—they simply rent them as a service, turning trust and digital identity into primary attack vectors.