CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft
2026-08-02T08:52:09Z•bd675b8d73dcf1b2b97d25145f2ccf2c26967c5541cba86b809d36769d680638
ACR StealerAI red teamingAI securityCaptiveCrunchClickFixMidnight BlizzardStorm-2945Teams social engineeringauthentication token theftbrowser credential theftcredential theftcyber resilienceleast privilegemalware deliveryphishingthreat intelligence
What happened
Microsoft Security Blog RSS feed covering July 2026 security topics, including the CaptiveCrunch campaign attributed to Storm-2945, a Midnight Blizzard sub-cluster, which compromises hospitality sign-in portals to deliver malware and steal traveler credentials. The feed also reports ACR Stealer ClickFix campaigns targeting browser credentials, authentication tokens, and sensitive documents; evolving phishing and Teams social-engineering trends; and AI security, red teaming, least-privilege, and cyber-resilience initiatives.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- microsoft_security_blog
- Record identifier
- bd675b8d73dcf1b2b97d25145f2ccf2c26967c5541cba86b809d36769d680638
- Enrichment time
- 2026-08-02T08:52:09Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.