CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft

Microsoft Security Blog reporting describes CaptiveCrunch, an ongoing campaign attributed to Storm-2945, a sub-cluster of the Russian Midnight Blizzard threat actor. Since May 2026, the group has reportedly compromised hospitality organizations’ sign-in portals, including hotels, to distribute malware to travelers and steal credentials. The activity represents a high-risk combination of supply-chain or trusted-service compromise, malware delivery, and credential theft targeting organizations and their customers.