Tag: code-signing certificates

2 Attack Reports | 0 Vulnerabilities

Attack reports

Exposing Fox Tempest: A malware-signing service operation

Fox Tempest is a financially motivated threat actor operating a malware-signing-as-a-service (MSaaS) business used by cybercriminals to distribute malicious code, including ransomware. The actor abuses Microsoft Artifact Signing to generate fraudulent code-signing certificates, allowing malware to …

oyster backdoor

vanilla tempest

code-signing certificates

malware-signing-as-a-service

ransomware enabler

Published: May 19, 2026

Downloadable IOCs: 3

Cooking up trouble: How TamperedChef uses signed apps to deliver stealthy payloads

The TamperedChef campaign is a global malvertising and SEO operation that distributes seemingly legitimate software with valid code signing to trick users into executing malicious installers. These fake applications mimic common software and establish persistence through scheduled tasks, delivering…

social engineering

scheduled tasks

javascript payload

shell companies

code-signing certificates

signed applications

Published: November 26, 2025

Downloadable IOCs: 132

Click here to see more Attack Reports