Microsoft Dismantles Malware-Signing Network Exploiting Azure Artifact Signing Service

Microsoft has announced the disruption of a large-scale malware-signing-as-a-service (MSaaS) operation that exploited its Azure Artifact Signing platform to generate fraudulent code-signing certificates. The operation enabled cybercriminals and ransomware groups to disguise malicious software as trusted applications, increasing the likelihood of successful infections.

According to a new report from Microsoft Threat Intelligence, the operation was run by a threat actor known as Fox Tempest. The group allegedly abused Microsoft’s Artifact Signing service to create short-lived digital certificates that allowed malware to appear legitimate to both users and operating systems.

Azure Artifact Signing, formerly known as Trusted Signing, was introduced by Microsoft in 2024 as a cloud-based solution that helps developers digitally sign software through Microsoft’s infrastructure. Investigators found that Fox Tempest leveraged the platform extensively, creating over 1,000 certificates along with hundreds of Azure tenants and subscriptions to facilitate its activities.

Microsoft has also revealed that it has initiated legal action against the cybercrime operation in the U.S. District Court for the Southern District of New York.

“Fox Tempest has created over a thousand certificates and established hundreds of Azure tenants and subscriptions to support its operations. Microsoft has revoked over one thousand code signing certificates attributed to Fox Tempest,” Microsoft said.

“May 2026, Microsoft’s Digital Crimes Unit (DCU), with support from industry partners, disrupted Fox Tempest’s MSaaS offering, targeting the infrastructure and access model that enables its broader criminal use.”

As part of the takedown effort, Microsoft seized the domain signspace[.]cloud, which was used to operate the service. The company also shut down hundreds of virtual machines linked to the operation and blocked access to infrastructure supporting the platform. Visitors attempting to access the domain are now redirected to a Microsoft-controlled page detailing the seizure and ongoing legal proceedings.

The investigation connected the service to several malware and ransomware campaigns involving Oyster, Lumma Stealer, Vidar, and ransomware families including Rhysida, Akira, INC, Qilin, and BlackByte. Microsoft stated that threat groups such as Vanilla Tempest, Storm-0501, Storm-2561, and Storm-0249 utilized malware signed through the service.

Vanilla Tempest, associated with INC Ransomware, has also been identified as a co-conspirator in Microsoft’s legal complaint. The company alleges that the group used the signing platform to distribute malware and ransomware against organizations globally.

Researchers found that the malware-signing operation enabled customers to upload malicious files and receive code-signed versions using fraudulently acquired certificates. The signed files often impersonated trusted software brands such as Microsoft Teams, AnyDesk, PuTTY, and Webex, making them appear more credible to potential victims.

“When unsuspecting victims executed the falsely named Microsoft Teams installer files, those files delivered a malicious loader, which in turn installed the fraudulently signed Oyster malware and ultimately deployed Rhysida ransomware,” reads Microsoft’s comp

[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.