---
title: "Cybercrime service disrupted for abusing Microsoft platform to sign malware"
url: https://daily.dev/posts/cybercrime-service-disrupted-for-abusing-microsoft-platform-to-sign-malware-dzilytjml
source_url: https://www.bleepingcomputer.com/news/security/cybercrime-service-disrupted-for-abusing-microsoft-platform-to-sign-malware
type: article
source: "BleepingComputer"
published: 2026-05-19T21:48:40.426Z
updated: 2026-05-20T00:48:12.027Z
tags: ["microsoft", "azure", "malware", "ransomware"]
reading_time: 4
upvotes: 0
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Cybercrime service disrupted for abusing Microsoft platform to sign malware

**[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 4 min read · 0 upvotes · 0 comments

## Summary

Microsoft's Digital Crimes Unit disrupted a malware-signing-as-a-service (MSaaS) operation called Fox Tempest that abused the Azure Artifact Signing platform to generate fraudulent code-signing certificates. The threat actor created over 1,000 certificates and hundreds of Azure tenants, using stolen identities and short-lived 72-hour certificates to evade detection. Signed malware was used in campaigns involving Lumma Stealer, Oyster, Rhysida, Akira, and other ransomware families. Microsoft seized the signspace[.]cloud domain, took hundreds of VMs offline, and filed a legal case in the Southern District of New York. The service was sold on Telegram for $5,000–$9,000 in bitcoin and generated millions in profits.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://www.bleepingcomputer.com/news/security/cybercrime-service-disrupted-for-abusing-microsoft-platform-to-sign-malware>

---

Tags: [#microsoft](https://daily.dev/tags/microsoft), [#azure](https://daily.dev/tags/azure), [#malware](https://daily.dev/tags/malware), [#ransomware](https://daily.dev/tags/ransomware)

[View this post on daily.dev](https://daily.dev/posts/cybercrime-service-disrupted-for-abusing-microsoft-platform-to-sign-malware-dzilytjml)