CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft

Microsoft Security Blog RSS entries covering the CaptiveCrunch campaign attributed to Storm-2945, a Midnight Blizzard sub-cluster, which compromised hospitality sign-in portals to deliver malware and steal credentials; ACR Stealer ClickFix campaigns targeting browser credentials, authentication tokens, and documents; broader phishing and Teams social-engineering trends; and AI security initiatives. The most actionable reports describe active credential theft and malware delivery campaigns observed in 2026.