Exposing Fox Tempest: A malware-signing service operation

The feed highlights multiple high-risk Microsoft Security Blog investigations and guidance. Key findings: Fox Tempest operates a malware‑signing‑as‑a‑service (MSaaS) that enables distribution of signed malware—used by ransomware and other criminal groups—undermining trust in code signing; Storm-2949 demonstrates how stolen identities/credentials can enable cloud‑wide data theft without malware; Kazuar is an evolving Russian state P2P botnet for persistent espionage; misconfigurations in cloud/Kubernetes AI apps can lead to RCE and data leaks; and attackers increasingly exploit trusted third‑‑‑