Exposing Fox Tempest: A malware-signing service operation

Reported 19 May 2026 by otx · Severity: medium

Fox Tempest is a financially motivated threat actor operating a malware-signing-as-a-service (MSaaS) business used by cybercriminals to distribute malicious code, including ransomware. The actor abuses Microsoft Artifact Signing to generate fraudulent code-signing certificates, a