Midnight Blizzard Hijacked Public Wi-Fi Portals to Steal Microsoft 365 Credentials

Microsoft linked the CaptiveCrunch campaign to Storm-2945, a subgroup of the Russian state-backed Midnight Blizzard actor, after attackers compromised captive portal ecosystems used by hospitality organizations and other shared public venues. By manipulating DNS and HTTP traffic on public Wi-Fi gateway infrastructure, the group conducted adversary-in-the-middle (AiTM) attacks that intercepted login flows and stole Microsoft 365 credentials from traveling employees across multiple sectors.

The operation also pushed follow-on malware and phishing lures through the hijacked portals. Victims were shown fake browser update prompts delivering malware including CornFlake and ChocoShell, alongside ClickFix-style social engineering and malicious Android APK prompts; some recent landing pages also added device code phishing, a technique Microsoft said Midnight Blizzard has used since 2024. The campaign has reportedly been active since May and focused on hospitality-linked networks and other public access environments where users expect captive portal authentication.