CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft

Since May 2026, Russia-linked Midnight Blizzard (Storm-2945) has been hijacking captive portal Wi-Fi networks at hotels and other venues worldwide to deliver sophisticated malware and steal credentials from travelers, using advanced adversary-in-the-middle tactics, AI-augmented phishing, and device code abuse to gain persistent access to corporate cloud environments.