$4.44M average. Wrong number to chase.
Per BleepingComputer, Microsoft disrupted a malware-signing-as-a-service operation, attributed to Fox Tempest, which weaponized the company's Artifact Signing system to deliver malicious code. The Hacker News reports this MSaaS scheme compromised thousands of machines and networks worldwide, with Cybersecurity360 noting the service made malware appear legitimate.
While many read this as a Microsoft vulnerability problem, it's actually a third-party assurance failure, as Matrice Digitale highlights the abuse of Azure Artifact Signing. According to CrowdStrike's 2025 report, 42% of exploited vulnerabilities were weaponized before public disclosure, underscoring the need for robust supply chain risk management.
The defensive math: -> Implement a 14-day review cycle for all third-party code-signing certificates, as Verizon's DBIR 2025 found 30% of breaches involved the human element. -> Use a service like GitHub's Code Signing to monitor and manage code-signing certificates, reducing the risk of fraudulent certificates. -> Conduct regular audits of your organization's code-signing processes, as IBM's Cost of a Data Breach Report 2025 found that AI/ML security insights can reduce breach costs by $223K.
What's the real cost of not reviewing your third-party code-signing certificates this quarter?