[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fu_EPt0TQU1S4zy_ePyUAuXf9csiayliGzMgCeUyZ3wg":3},{"article":4,"iocs":55,"watch_terms":59,"solutions":60,"lesson":153},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"2828a538-36aa-4636-95c9-f25851c9f4f9","CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft","captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-9a0968","Storm-2945, a sub-cluster of the Russian threat actor Midnight Blizzard, has been observed compromising the sign-in portals of hospitality-related organizations such as hotels since May 2026 in order to deliver malware to travelers and steal credentials in an operation we call CaptiveCrunch. The post CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft appeared first on Microsoft Security Blog.","A sub-cluster of the Russian threat actor Midnight Blizzard, known as Storm-2945, is conducting the CaptiveCrunch campaign, targeting travelers worldwide by compromising hotel captive portals since May 2026. The campaign uses AI-augmented techniques, including adversary-in-the-middle phishing and malware delivery disguised as updates, to steal credentials and session tokens, and gain remote access.","Midnight Blizzard sub-cluster Storm-2945 targets travelers via hotel captive portals.","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2026\u002F07\u002F31\u002Fcaptivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft\u002F","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002Fwp-content\u002Fuploads\u002F2026\u002F07\u002FFeatured-image-CaptiveCrunch-1.png","2026-07-31T21:01:37+00:00","2026-08-01T00:00:10.989097+00:00",9,[17,20,22,25,28,30],{"name":18,"type":19},"Midnight Blizzard","threat_actor",{"name":21,"type":19},"Storm-2945",{"name":23,"type":24},"CaptiveCrunch","campaign",{"name":26,"type":27},"Microsoft Defender for Endpoint","product",{"name":29,"type":27},"Microsoft Defender for Identity",{"name":31,"type":27},"Microsoft Defender XDR","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":32,"icon":34,"name":35,"slug":36},null,"Nation-state","nation-state",[38,43,45,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56],{"type":49,"value":57,"context":58},"Windows RAT","Remote access trojan delivered by Storm-2945.",[26,29,31],{"controls":61,"vendors":146},[62,91,117],{"slug":63,"name":64,"problem":65,"products":66},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[67,75,83],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"slug":92,"name":93,"problem":94,"products":95},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[96,101,109],{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":97,"product_name":98,"url":99,"description":100},"identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"slug":118,"name":119,"problem":120,"products":121},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[122,130,138],{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",[147],{"slug":148,"name":149,"logo_path":150,"roles":151},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[152],"reported_by",{"slug":154,"title":155,"body":156,"framework_refs":157,"framework_notes":170},"midnight-blizzard-hijacks-hotel-wi-fi-portals-to-steal-traveler-credentials","Midnight Blizzard Hijacks Hotel Wi-Fi Portals to Steal Traveler Credentials","The CaptiveCrunch campaign exploits a fundamental trust gap: travelers connecting to hotel Wi-Fi routinely accept captive portal prompts without verifying their legitimacy, making them easy targets for adversary-in-the-middle (AiTM) attacks. By compromising hotel captive portal infrastructure, Storm-2945 intercepts authentication flows to harvest credentials and session tokens before victims even realize they're on a malicious network. The use of AI-augmented phishing and fake software update lures dramatically lowers the technical barrier for deception, meaning even cautious users can be fooled. This campaign is particularly dangerous because it targets travelers in high-value contexts — business trips, diplomatic travel, and corporate events — where sensitive accounts and VPN credentials are frequently in use. The consequences extend beyond individual victims, as stolen session tokens can bypass multi-factor authentication entirely.",[158,159,160,161,162,163,164,165,166,167,168,169],"CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 6: Access Control Management","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-63B: Digital Identity Guidelines (Phishing-Resistant MFA)","NIST AC-17: Remote Access","NIST IA-2(6): Multi-Factor Authentication","NIST SI-3: Malicious Code Protection","NIST SP 800-207: Zero Trust Architecture","MITRE ATT&CK T1557: Adversary-in-the-Middle","MITRE ATT&CK T1566: Phishing","MITRE ATT&CK T1539: Steal Web Session Cookie","GDPR Article 32: Security of Processing (for hotel operators handling guest data)",{}]