Microsoft disrupted Fox Tempest, a cybercriminal operation that fraudulently obtained Microsoft code-signing certificates and resold them to threat actors deploying Rhysida ransomware, Lumma Stealer, and Vidar infostealer. The signed malware bypassed endpoint security controls on thousands of machines before takedown, enabling ransomware attacks on hospitals and critical infrastructure alongside large-scale credential theft. Microsoft has revoked the fraudulent certificates, but organizations must audit their environments for prior compromise and harden certificate validation processes immediately.