Threat-Intel - 1

security: CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft

Microsoft says Storm-2945, a sub-cluster of Midnight Blizzard, has been compromising sign-in portals at hospitality organizations since May 2026 to deliver malware to travelers and steal credentials. The campaign is named CaptiveCrunch and targets travelers worldwide.