CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft

Microsoft Security Blog RSS content reports threat activity including Storm-2945, a Midnight Blizzard sub-cluster, compromising hospitality organization sign-in portals to deliver malware to travelers and steal credentials in the CaptiveCrunch operation. It also describes ACR Stealer campaigns using ClickFix lures to steal browser credentials, authentication tokens, and sensitive enterprise documents, alongside broader phishing, Teams social engineering, AI security, and supply-chain security updates.