CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft
Midnight Blizzard sub-cluster Storm-2945 targets travelers via hotel captive portals.
A sub-cluster of the Russian threat actor Midnight Blizzard, known as Storm-2945, is conducting the CaptiveCrunch campaign, targeting travelers worldwide by compromising hotel captive portals since May 2026. The campaign uses AI-augmented techniques, including adversary-in-the-middle phishing and malware delivery disguised as updates, to steal credentials and session tokens, and gain remote access.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft Defender for Endpoint?
Get an email when a new story names Microsoft Defender for Endpoint, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe CaptiveCrunch campaign exploits a fundamental trust gap: travelers connecting to hotel Wi-Fi routinely accept captive portal prompts without verifying their legitimacy, making them easy targets for adversary-in-the-middle (AiTM) attacks. By compromising hotel captive portal infrastructure, Storm-2945 intercepts authentication flows to harvest credentials and session tokens before victims even realize they're on a malicious network. The use of AI-augmented phishing and fake software update lures dramatically lowers the technical barrier for deception, meaning even cautious users can be fooled. This campaign is particularly dangerous because it targets travelers in high-value contexts — business trips, diplomatic travel, and corporate events — where sensitive accounts and VPN credentials are frequently in use. The consequences extend beyond individual victims, as stolen session tokens can bypass multi-factor authentication entirely.
What helps against this
How we list vendors
- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Windows RAT