CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft

Microsoft Security Blog RSS content covering July 2026 security developments, including the CaptiveCrunch campaign attributed to Storm-2945/Midnight Blizzard targeting hospitality sign-in portals to deliver malware and steal credentials, ACR Stealer campaigns using ClickFix lures to harvest browser credentials and tokens, evolving phishing and Teams social-engineering trends, and guidance on AI security and least privilege. The most directly actionable threat reporting concerns credential theft, malware delivery, and automated multi-stage intrusion chains.