Cybercrime service disrupted for abusing Microsoft platform to sign malware

Microsoft disrupted a criminal malware-signing-as-a-service (MSaaS) run by the actor dubbed Fox Tempest that abused Microsoft’s Artifact Signing platform to produce short-lived, fraudulently obtained code-signing certificates used to sign and legitimize malware and ransomware; the operation generated over 1,000 certificates, supported hundreds of Azure tenants, was tied to multiple malware and ransomware families (including Oyster, Lumma, Vidar, Rhysida and others), and has been the subject of legal action and infrastructure takedowns by Microsoft.