Microsoft Disrupts Malware‑Signing‑as‑a‑Service Operation Using Artifact Signing

Microsoft disrupted a malware‑signing‑as‑a‑service operation that weaponized its Artifact Signing system to deliver malicious code and conduct ransomware and other attacks. The threat actor, dubbed Fox Tempest, used the signing service to produce signed binaries that appeared legitimate, allowing the malware to bypass security controls. Thousands of machines and networks worldwide were compromised through the signed binaries. Microsoft attributed the activity to Fox Tempest and halted the signing operation, preventing further malicious use. The incident highlights the risk of abusing legitimate signing infrastructure for malicious purposes. Security teams should verify the integrity of signed binaries and monitor for unauthorized signing certificates. The disruption prevented the spread of malware that could have caused widespread damage.