Fox Tempest operated a malware-signing-as-a-service business that exploited Microsoft Artifact Signing to generate fraudulent code-signing certificates, allowing malware to evade security controls. The actor created over a thousand certificates and established hundreds of Azure tenants to facilitate their operations. Microsoft intervened in May 2026, revoking the certificates and disrupting the service via its Digital Crimes Unit. This operation enabled distribution of ransomware (e.g., Rhysida) and malware families such as Oyster, Lumma Stealer, and Vidar. The service was monetized through signspace.cloud, charging substantial fees for signing malware. The campaign affected multiple global sectors, including healthcare, education, government, and financial services.

The fraudulent code-signing certificates issued by Fox Tempest allowed malware to bypass security controls, increasing the likelihood of successful infections. The operation facilitated ransomware deployment and distribution of various malware families, impacting critical sectors worldwide. Microsoft's revocation of over one thousand certificates and disruption of the service mitigated ongoing abuse. No known exploits in the wild remain active following this intervention.

Microsoft has revoked the fraudulent certificates and disrupted the Fox Tempest malware-signing service through its Digital Crimes Unit as of May 2026. Organizations should ensure their security solutions validate code-signing certificates against updated revocation lists. Monitoring for indicators such as the domain signspace.cloud and associated malware hashes can aid detection. Patch status is not applicable as this is an abuse of legitimate signing infrastructure rather than a software vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.