Code-Signing Abuse × Microsoft Artifact Signing

exploited Microsoft's Artifact Signing infrastructure to digitally sign malicious code... bypass endpoint security defenses that trust Microsoft-signed binaries

Attackers used the Fox Tempest service to obtain valid digital signatures from Microsoft's Artifact Signing infrastructure for malware. Signed malware appears legitimate to security tools that rely on code-signing trust, defeating reputation-based and signature-based detection on endpoints.

Monitor for binaries signed by Microsoft's Artifact Signing service that exhibit suspicious behaviors (e.g., unusual network connections, process injections) or originate from non-standard locations. Enforce application control policies to restrict execution to only trusted, verified software and ensure endpoint detection rules flag anomalies in signed binaries.