CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft

Microsoft Security Blog RSS content reports that Storm-2945, a sub-cluster of the Russian Midnight Blizzard threat actor, has compromised hospitality organization sign-in portals since May 2026 in the CaptiveCrunch operation to deliver malware to travelers and steal credentials. The feed also highlights ACR Stealer campaigns using ClickFix lures to obtain browser credentials, authentication tokens, and sensitive documents, alongside broader phishing, Teams social-engineering, AI-security, and supply-chain security topics.