Microsoft disrupted a major malware-signing-as-a-service (MSaaS) operation run by a financially motivated group dubbed Fox Tempest, which abused Microsoft’s Artifact Signing platform to make malware appear as trusted software. Active since May 2025, Fox Tempest created over 1,000 short-lived (72-hour) fraudulent code-signing certificates and hundreds of Azure tenants, selling access via the signspace[.]cloud site for $5,000–$9,000. Cybercriminals uploaded malicious binaries to be signed, then distributed them as fake installers for tools like Microsoft Teams, AnyDesk, PuTTY, and Webex. Because they were signed via Artifact Signing, Windows and security tools initially treated them as legitimate which allowed to the deployment of malware such as Oyster, Lumma Stealer, Vidar, and ransomware from Rhysida, INC, Qilin, Akira, BlackByte, and others. Threat actor campaigns were observed using purchased ads and spoofed download sites to lure victims. As part of “OpFauxSign,” Microsoft seized the signspace domain, took hundreds of Fox Tempest VMs offline, blocked supporting infrastructure, and revoked more than 1,000 certificates.