# Microsoft Disrupts Major Malware-Signing-as-a-Service Operation Abusing Azure Platform
Fox Tempest cybercrime service created over 1,000 fraudulent code-signing certificates to legitimize ransomware and stealer malware
Microsoft has successfully disrupted a sophisticated malware-signing-as-a-service (MSaaS) operation run by the financially motivated threat actor tracked as Fox Tempest, which exploited the company's Azure Artifact Signing platform to generate fraudulent code-signing certificates for use by ransomware gangs and other cybercriminals. The enforcement action, unsealed in U.S. District Court for the Southern District of New York, marks a significant blow against an infrastructure-as-a-service model that has become increasingly central to organized cybercrime.
According to Microsoft's Threat Intelligence team, the operation generated more than 1,000 code-signing certificates and controlled hundreds of Azure tenants and subscriptions. The scheme allowed criminal customers to upload malicious files through the signspace[.]cloud platform and have them digitally signed using fraudulently obtained certificates—a critical capability that allowed malware to bypass security controls and appear as legitimate software to both users and operating systems.
## What Is Azure Artifact Signing?
Azure Artifact Signing (formerly Trusted Signing) is a legitimate cloud-based code-signing service launched by Microsoft in 2024 to streamline the process of digitally signing software. Developers can use the platform to automatically have their applications signed with certificates from a Microsoft-trusted root authority, a process that historically required complex certificate management infrastructure.
The service was designed with legitimate developers in mind. Digital code signatures serve a critical security function: they verify the authenticity and integrity of software and confirm that code hasn't been tampered with since it was signed. When a user downloads an executable or installer, their operating system checks whether it carries a valid signature from a trusted certificate authority. Signed code is less likely to trigger security warnings and is more readily trusted by end users.
This trust mechanism is fundamental to modern software security. Microsoft Windows, for instance, uses code-signing certificates as a primary mechanism to distinguish legitimate software from potential malware. Attackers, therefore, have long sought to abuse legitimate code-signing infrastructure to lend credibility to their malicious payloads.
## The Fox Tempest Operation: Scale and Scope
The Fox Tempest operation represents one of the most significant abuses of a legitimate security service to date. According to Microsoft's legal complaint and threat intelligence disclosures, the operation:
The operational scope was extensive. Microsoft identified connections to numerous threat actors, including:
| Threat Actor | Primary Malware | Campaign Focus |
|---|---|---|
| Storm-0501 | Oyster, Lumma Stealer | Multi-sector attacks |
| Storm-2561 | Vidar stealer | Credential theft |
| Storm-0249 | Multiple families | Targeted campaigns |
| Vanilla Tempest | INC Ransomware | Enterprise ransomware |
The Vanilla Tempest group was named as a co-conspirator in the legal action, having used the MSaaS platform to distribute ransomware globally.
## How the Attack Chain Worked
The technical execution of this scheme reveals how attackers weaponized a legitimate Microsoft service against its intended purpose:
1. Certificate Acquisition: Threat actors used fraudulently obtained or stolen identities from the US and Canada to register Azure tenants and verify their identity with Microsoft's systems.
2. Malware Upload: Cybercriminal customers of Fox Tempest uploaded malicious files—including stealer malware, loaders, and ransomware payloads—to signspace[.]cloud.
3. Digital Signing: The platform used the fraudulently obtained certificates from Azure Artifact Signing to digitally sign the malware, lending it apparent legitimacy.
4. Impersonation: The signed malware was repackaged to impersonate legitimate software, including:
- Microsoft Teams installers
- AnyDesk remote access software
- PuTTY SSH client
- Webex conferencing platform
5. Execution & Payload Delivery: When victims executed the falsely-named installers, they ran digitally signed malware that Windows initially recognized as legitimate. The signed Oyster malware loader then installed additional payloads, including Rhysida ransomware.
A concrete example documented by Microsoft: when an unsuspecting victim ran what appeared to be a Microsoft Teams installer, they unwittingly executed a malware loader signed with a fraudulent Microsoft certificate. This loader deployed the Oyster malware, which subsequently installed Rhysida ransomware—causing significant financial damage to the victim organization.
## The Ransomware Connection
The operation's primary customers were major ransomware-as-a-service (RaaS) operators, including:
The use of digitally signed malware significantly increases the probability of successful infection. Signed payloads bypass email gateway security controls, avoid triggering user-facing security warnings, and pass initial trust checks by endpoint security software. This translates directly to higher infection rates and larger ransomware payouts for the gangs using Fox Tempest's services.
## Microsoft's Takedown Response
On May 19, 2026, Microsoft's Digital Crimes Unit (DCU), in coordination with industry partners, executed a comprehensive takedown:
Microsoft stated: "Fox Tempest has created over a thousand certificates and established hundreds of Azure tenants and subscriptions to support its operations. In May 2026, Microsoft's Digital Crimes Unit, with support from industry partners, disrupted Fox Tempest's MSaaS offering, targeting the infrastructure and access model that enables its broader criminal use."
## Implications for Organizations and Security
This operation exposes critical vulnerabilities in how legitimate security infrastructure can be weaponized:
For Security Teams: Organizations must assume that digitally signed files are not inherently trustworthy. While code signatures should never be ignored, they should be one component of a layered defense strategy. User awareness training must emphasize that legitimate-looking installers—even those with valid digital signatures—may still be malicious.
For Developers: The incident underscores the importance of secure identity verification. Organizations using code-signing services should implement multi-factor authentication, monitor certificate issuance, and maintain detailed logs of signing activity.
For Cloud Platforms: Microsoft's experience demonstrates the need for continuous monitoring of identity verification systems and certificate issuance patterns. Anomalous patterns—such as dozens of identities registering from the same IP address or a single account issuing thousands of certificates—should trigger automatic investigation.
---
## HackWire Analysis
This takedown matters not because Fox Tempest is gone, but because it illustrates how cybercrime-as-a-service has matured into legitimate infrastructure abuse. The group didn't build a sophisticated signing system from scratch—they simply weaponized Microsoft's own platform using social engineering and stolen identities, creating a low-friction signing service for dozens of downstream threat actors.
The 72-hour certificate validity window is particularly revealing. Fox Tempest operators understood the detection vectors and deliberately minimized exposure by cycling certificates constantly. This sophistication suggests the operation was run by experienced infrastructure operators, not opportunistic attackers.
The broader pattern is troubling: as legitimate security services become more accessible and automated, they become more attractive targets. Two-year-old Azure Artifact Signing was compromised within months of launch. Similar risks likely exist across other recently-launched Microsoft services, AWS offerings, and third-party platforms. Organizations providing identity verification at scale face an inherent tension between usability and security.
The ransomware connection is also significant. Major RaaS operators now outsource code-signing to specialized services rather than maintaining in-house signing infrastructure. This fragmentation of capabilities actually creates detection opportunities—if Microsoft monitors signature issuance patterns across all Azure tenants, anomalies should be caught earlier in future incidents.
For defenders, the takeaway is straightforward: code signatures are now a liability vector that attackers actively exploit. Organizations should implement application whitelisting based on publisher reputation (not just valid signatures), monitor for suspicious installer downloads, and treat any large-scale distribution of software as a potential attack vector regardless of signature validity.
— HackWire Editorial
---
## Related Coverage