{"id":13006,"date":"2026-05-20T10:04:10","date_gmt":"2026-05-20T10:04:10","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/05\/20\/fox-tempest-malware-signing-service-abused-microsoft-artifact-signing-to-certify-malware\/"},"modified":"2026-05-20T10:04:10","modified_gmt":"2026-05-20T10:04:10","slug":"fox-tempest-malware-signing-service-abused-microsoft-artifact-signing-to-certify-malware","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/05\/20\/fox-tempest-malware-signing-service-abused-microsoft-artifact-signing-to-certify-malware\/","title":{"rendered":"Fox Tempest Malware-Signing Service Abused Microsoft Artifact Signing to Certify Malware"},"content":{"rendered":"

Fox Tempest Malware-Signing Service Abused Microsoft Artifact Signing to Certify Malware
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

A financially motivated threat actor known as Fox Tempest has been operating a sophisticated malware-signing-as-a-service (MSaaS)<\/a> platform that abused Microsoft\u2019s Artifact Signing infrastructure to generate trusted digital signatures for malicious code.<\/p>\n

This activity enabled cybercriminals to bypass security controls and distribute malware that appeared to be legitimately signed.<\/p>\n

In May 2026, Microsoft\u2019s Digital Crimes Unit (DCU), in collaboration with Resecurity, disrupted the group\u2019s infrastructure, revoking more than 1,000 fraudulent certificates linked to the operation.<\/p>\n

Abuse of Microsoft Artifact Signing<\/strong><\/h2>\n

Fox Tempest leveraged Microsoft\u2019s Artifact Signing service (formerly Azure Trusted Signing) to obtain short-lived code-signing certificates valid for up to 72 hours.<\/p>\n

These certificates enabled attackers to sign malware binaries so they appeared as trusted applications, including spoofed versions of popular software such as Microsoft Teams, AnyDesk, PuTTY,<\/a> and Webex.<\/p>\n

To obtain these certificates, the threat actor likely used stolen or synthetic identities from the United States and Canada to pass Microsoft\u2019s identity verification checks.<\/p>\n

The operation was facilitated through a now-defunct platform,\u00a0signspace[.]cloud, which provided a user interface that allowed customers to upload malicious files and receive digitally signed binaries.<\/p>\n

Microsoft Threat Intelligence has tracked Fox Tempest since September 2025, identifying it as a key enabler within the ransomware ecosystem rather than a direct attacker.<\/p>\n

\"Accessing
Accessing VM provided by Fox Tempest<\/em>(source: Microsoft)<\/figcaption><\/figure>\n

The group created hundreds of Azure tenants <\/a>and subscriptions to support its operations and issued thousands of certificates at scale.<\/p>\n

In early 2026, Fox Tempest evolved its infrastructure by offering pre-configured virtual machines (VMs) hosted on third-party providers.<\/p>\n

These VMs enabled customers to upload payloads directly into controlled environments, where automated scripts and configuration files (e.g., metadata.json and PowerShell scripts) were used to efficiently sign malware.<\/p>\n

This shift improved operational security and streamlined the signing process.<\/p>\n

\"Vanilla
Vanilla Tempest and Fox Tempest attack chain<\/em>(source :microsoft)<\/figcaption><\/figure>\n

Fox Tempest\u2019s MSaaS platform has been linked to multiple high-profile threat actors and ransomware families.<\/p>\n

Groups such as Vanilla Tempest<\/a>, Storm-0501, Storm-2561, and Storm-0249 used Fox Tempest-signed malware in real-world intrusions.<\/p>\n

Associated malware includes Rhysida ransomware, Lumma Stealer, Vidar infostealer, and the Oyster (Broomstick) backdoor.<\/p>\n

One observed attack chain involved trojanized Microsoft Teams<\/a> installers distributed via malvertising.<\/p>\n

Victims downloading the fake installer executed a signed binary that deployed the Oyster backdoor, enabling persistence, command-and-control (C2) communication, and eventual ransomware deployment.<\/p>\n

\"\u00a0Google
\u00a0Google form used by Fox Tempest<\/em>(source :microsoft )<\/figcaption><\/figure>\n

Cryptocurrency analysis indicates that Fox Tempest is closely tied to ransomware affiliates behind families such as Qilin, Akira, and INC, with revenues reaching millions of dollars.<\/p>\n

Fox Tempest operated as a commercial service, charging cybercriminals between $5,000 and $9,000 for malware-signing services.<\/p>\n

Access was managed through Telegram channels and online forms, with higher-paying customers receiving priority.<\/p>\n

\"Telegram
Telegram used by Fox Tempest<\/em>(source : Microsoft)<\/figcaption><\/figure>\n

The service lowered the barrier to entry for less sophisticated threat actors by providing trusted code-signing capabilities on demand.<\/p>\n

Indicators of Compromise (IOCs)<\/strong><\/p>\n

Indicators of Compromise (IOCs) linked to Fox Tempest activity include the domain signspace[.]cloud<\/code>.<\/p>\n

Investigators also identified the following SHA-1 certificate fingerprints:<\/p>\n