FruitStone

Microsoft warns of CaptiveCrunch campaign targeting travelers through hotel networks and stealing credentials

Microsoft detected a campaign conducted by Storm-2945, a subgroup of Midnight Blizzard, to manipulate traffic through hotel networks and captive portals in order to distribute malware and steal passwords, cookies, and Microsoft 365 session tokens. The campaign also uses phishing pages that exploit the Microsoft Entra ID device code authentication flow.