CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft

Microsoft Security Blog RSS feed containing July 2026 security content. The most significant reported threat is CaptiveCrunch, an operation by Storm-2945, a Midnight Blizzard sub-cluster, compromising hospitality organizations’ sign-in portals to deliver malware to travelers and steal credentials. The feed also covers ACR Stealer campaigns using ClickFix lures to steal browser credentials, authentication tokens, and sensitive documents, along with broader phishing, Teams social engineering, AI security, and least-privilege guidance.