Microsoft disrupted Fox Tempest, a malware-signing-as-a-service (MSaaS) that allowed attackers to sign malware with fake trusted certificates.
Microsoft said it disrupted a cybercrime operation run by a threat actor named Fox Tempest, which helped threat actors sign malware with short-lived certificates to make malicious software appear legitimate. The service abused Microsoft Artifact Signing and supported ransomware and malware campaigns.
Microsoft seized the infrastructure the group was running on, pulled the fraudulent accounts, and tightened up the verification processes that had been abused. It also filed a lawsuit against Fox Tempest and Vanilla Tempest, a legal move that in these kinds of operations does real practical work: it gives Microsoft the grounds to seize domains, tear down server infrastructure, and push third-party providers to pull the plug on whatever is still running.
Microsoft said Fox Tempest created over 1,000 certificates and set up hundreds of Azure tenants and subscriptions to support its malware-signing-as-a-service operation. The IT giant revoked more than 1,000 code-signing certificates linked to the group.
In May 2026, Microsoft’s Digital Crimes Unit, with industry partners, dismantled Fox Tempest’s infrastructure. The service had been used to sign and distribute malware, including Rhysida ransomware, Oyster, Lumma Stealer, and Vidar, making malicious software appear legitimate and easier to deliver at scale.
Microsoft Threat Intelligence researchers pointed out that Fox Tempest does not directly attack victims but instead provides infrastructure and services that support ransomware groups. Since September 2025, it has been linked to operators like Vanilla Tempest, Storm-0501, Storm-2561, and Storm-0249, which used Fox Tempest-signed malware in real attacks delivered through malvertising, SEO poisoning, and fake ads.
The group is also tied to ransomware affiliates behind families such as INC, Qilin, and Akira, with millions in alleged proceeds.
“Based on the scale of the MSaaS offering, Microsoft Threat Intelligence assesses that Fox Tempest is a well-resourced group handling infrastructure creation, customer relations, and financial transactions.” states Microsoft. “The downstream impact of these operations has resulted in attacks against a broad range of industry sectors, including healthcare, education, government, and financial services, impacting organizations globally including, but not limited to the United States, France, India, and China.”
Fox Tempest operated a malware-signing-as-a-service platform called signspace[.]cloud, disrupted by its Microsoft experts at the Digital Crimes Unit. The service allowed threat actors to obtain short-lived (72-hour) Microsoft-issued certificates via Artifact Signing, enabling malicious files to appear legitimate and bypass security controls.
To obtain certificates, users had to pass identity verification, suggesting the likely use of stolen identities. The platform included admin and customer portals where malicious files were uploaded and signed, with infrastructure built on Azure and linked to a GitHub repository named code-signing-service.
In February 2026, Fox Tempest evolved its operation by providing pre-configured virtual machines hosted on third-party infrastructure, letting customers directly submit malware for signing. This reduced friction and improved scalability, further enabling the distribution of trusted but malicious binaries. Microsoft said it disrupted this infrastructure and continues to work with partners to counter similar abuse.
Fox Tempest monetized its malware-signing-as-a-service by charging thousands of dollars for access. Customers chose plans between $5,000 and $9,000, with higher tiers getting priority access and virtual machines for signing malicious code with trusted certificates.
Fox Tempest didn’t just build the tool and walk away. The operation was actively run on Telegram, where channels advertised EV certificate access and buyers coordinated payments. Rather than a hidden underground network, it functioned more like a service with a clear customer base, managed through a small set of accounts and shared infrastructure. This centralized setup made it possible to sign malware at scale while keeping operations relatively streamlined and repeatable.
Microsoft recommends layered defenses against Fox Tempest attacks, including cloud protection, Safe Links/Attachments, SmartScreen, and strong identity controls. Key steps also include tamper protection, limiting admin rights, and enabling attack surface reduction rules.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Fox Tempest)
