CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft
2026-08-04T14:52:10Z•2040085df45a8126885896ee76e4561b1b7c057b2225202b960414a0c4867e7d
ACR StealerAI securityCaptiveCrunchClickFixMidnight BlizzardRussian threat actorStorm-2945Teams phishingauthentication token theftbrowser credential theftcredential thefthospitality sectorincident responseinformation theftmalware deliveryphishingsocial engineering
What happened
Microsoft Security Blog RSS content reports on the CaptiveCrunch campaign attributed to Storm-2945, a sub-cluster of Russian actor Midnight Blizzard, which compromised hospitality organizations’ sign-in portals to deliver malware to travelers and steal credentials. The feed also covers ACR Stealer ClickFix campaigns targeting browser credentials, authentication tokens, and sensitive documents, alongside broader phishing, AI security, red teaming, and defensive security topics.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- microsoft_security_blog
- Record identifier
- 2040085df45a8126885896ee76e4561b1b7c057b2225202b960414a0c4867e7d
- Enrichment time
- 2026-08-04T14:52:10Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.