Fox Tempest operated a platform called signspace[.]cloud, which allowed threat actors to obtain short-lived Microsoft-issued certificates via Artifact Signing.
The campaign involves scammers posing as recruiters and inviting victims to online interviews via custom platforms that mimic legitimate services like Cisco Webex.
The CRPx0 campaign, analyzed by Aryaka Threat Research Labs, uses a malicious zip file containing a shortcut that appears to lead to free OnlyFans accounts.