Microsoft Disrupts Fox Tempest Malware-Signing Service Used in Ransomware Attacks
Summary
Microsoft says it disrupted Fox Tempest’s OpFauxSign malware-signing service, which abused Artifact Signing and fraudulent short-lived certificates to distribute signed malware, including Rhysida, Oyster, Lumma Stealer and Vidar, and support ransomware attacks.
Key points
- Microsoft says it seized the OpFauxSign website, took hundreds of virtual machines offline and blocked access to the underlying code.
- The service allegedly used fraudulent, short-lived code-signing certificates to make malicious files appear legitimate and evade security controls.
- Microsoft attributed the operation to Fox Tempest, which it says has been active since May 2025.
- The service was used to distribute Rhysida, Oyster, Lumma Stealer and Vidar; Microsoft linked Rhysida deployments to Vanilla Tempest.
- Microsoft said the operation compromised thousands of machines and networks and that related attacks targeted healthcare, education, government and financial organizations.
- Microsoft said the service shifted in February 2026 to offering preconfigured virtual machines hosted on Cloudzy.
Article Details
- Event Type
- Microsoft disruption and seizure of Fox Tempest’s malware-signing-as-a-service operation, codenamed OpFauxSign.
- Impact
- The operation abused Artifact Signing and fraudulent short-lived certificates to distribute signed malware, evade security controls, and support ransomware and other attacks. Microsoft said the activity compromised thousands of machines and networks worldwide and enabled the distribution of Rhysida, Oyster, Lumma Stealer, and Vidar. Attacks targeted healthcare, education, government, and financial services.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | signspace[.]cloud | Fox Tempest's operation website, seized by Microsoft as part of the disruption. |
MITRE ATT&CK
People
Threat Actors
AkiraNamed among ransomware operations with affiliates reportedly connected to Fox Tempest's service; the article says attacks mounted by these operations targeted organizations across several sectors.BlackByteNamed among ransomware operations with affiliates reportedly connected to Fox Tempest's service; the article says attacks mounted by these operations targeted organizations across several sectors.Fox TempestMicrosoft attributed the malware-signing-as-a-service operation OpFauxSign to Fox Tempest, which allegedly used fraudulent certificates to supply signed malware and support cybercriminal attacks.INCNamed among ransomware operations with affiliates reportedly connected to Fox Tempest's service; the article says attacks mounted by these operations targeted organizations across several sectors.QilinNamed among ransomware operations with affiliates reportedly connected to Fox Tempest's service; the article says attacks mounted by these operations targeted organizations across several sectors.Vanilla TempestMicrosoft said threat actors such as Vanilla Tempest deployed Rhysida ransomware enabled by the signing service.
Malware
Broomsticksearching for Microsoft Teams to bogus download pages, paving the way for the deployment of Oyster (aka Broomstick or CleanUpLoader), a modular implant and loader that’s responsible for delivering Rhysida ransomware.Lumma StealerThe scheme enabled signed malware and loaders such as Rhysida, Oyster, Lumma Stealer, and Vidar to evade defenses and target healthcare, education, government, and financial organizations.OysterThe scheme enabled signed malware and loaders such as Rhysida, Oyster, Lumma Stealer, and Vidar to evade defenses and target healthcare, education, government, and financial organizations.OysterLoaderTeams to bogus download pages, paving the way for the deployment of Oyster (aka Broomstick or CleanUpLoader), a modular implant and loader that’s responsible for delivering Rhysida ransomware.RhysidaThe scheme enabled signed malware and loaders such as Rhysida, Oyster, Lumma Stealer, and Vidar to evade defenses and target healthcare, education, government, and financial organizations.VidarThe scheme enabled signed malware and loaders such as Rhysida, Oyster, Lumma Stealer, and Vidar to evade defenses and target healthcare, education, government, and financial organizations.
Vendors
Products
AnyDeskThis, in turn, allowed malware and ransomware to masquerade as legitimate software like AnyDesk, Microsoft Teams, PuTTY, and Cisco Webex.Artifact SigningMicrosoft disrupted Fox Tempest’s malware-signing-as-a-service operation, OpFauxSign, which abused Artifact Signing to distribute trusted-looking malicious code and support ransomware activity worldwide.Cisco WebExThis, in turn, allowed malware and ransomware to masquerade as legitimate software like AnyDesk, Microsoft Teams, PuTTY, and Cisco Webex.Microsoft TeamsThis, in turn, allowed malware and ransomware to masquerade as legitimate software like AnyDesk, Microsoft Teams, PuTTY, and Cisco Webex.PuTTYThis, in turn, allowed malware and ransomware to masquerade as legitimate software like AnyDesk, Microsoft Teams, PuTTY, and Cisco Webex.
Countries
Canada(VC), which suggests the threat actor very likely used stolen identities based in the United States and Canada to masquerade as a legitimate entity and obtain the necessary digital credentials for signing,” MicrosoftChinaAttacks mounted by these operations have targeted healthcare, education, government, and financial services located across the U.S., France, India, and China.FranceAttacks mounted by these operations have targeted healthcare, education, government, and financial services located across the U.S., France, India, and China.IndiaAttacks mounted by these operations have targeted healthcare, education, government, and financial services located across the U.S., France, India, and China.United StatesAttacks mounted by these operations have targeted healthcare, education, government, and financial services located across the U.S., France, India, and China.
Industries
EducationThe scheme enabled signed malware and loaders such as Rhysida, Oyster, Lumma Stealer, and Vidar to evade defenses and target healthcare, education, government, and financial organizations.Financial ServicesAttacks mounted by these operations have targeted healthcare, education, government, and financial services located across the U.S., France, India, and China.GovernmentThe scheme enabled signed malware and loaders such as Rhysida, Oyster, Lumma Stealer, and Vidar to evade defenses and target healthcare, education, government, and financial organizations.HealthcareThe scheme enabled signed malware and loaders such as Rhysida, Oyster, Lumma Stealer, and Vidar to evade defenses and target healthcare, education, government, and financial organizations.