57
57
57
57
57
57
60
42
30
60
57
55
CaptiveCrunch: Midnight Blizzard Weaponizes Hotel Wi-Fi Captive Portals to Steal Microsoft 365 Credentials
Zscaler details CaptiveCrunch: Midnight Blizzard's Storm-2945 compromises hotel Wi-Fi captive portals to redirect guests and harvest Microsoft 365 credentials via device code phishing.
Zscaler ThreatLabz analyzed the CaptiveCrunch credential theft campaign first reported by Microsoft on July 31. Microsoft attributes the activity to Storm-2945, a sub-cluster of Russia-linked Midnight Blizzard (APT29, Cozy Bear, NOBELIUM, BlueBravo). The actor manipulates DNS and HTTP traffic on captive portal networks at hotels and conference centers, redirecting victims to attacker-controlled infrastructure for Microsoft 365 credential harvesting, device code phishing, and malware delivery. Evidence indicates shared captive portal services were compromised rather than each venue being breached individually.
72
42
55
57
57
57
30
57
30
42
60
45
35
60
45
Anthropic Says Russian Hackers Used Claude AI to Automate Malware Evasion
Anthropic disrupted Midnight Blizzard campaigns where AI agents automatically rebuilt malware to evade detection, targeting 20+ government and defense organizations.
Anthropic's threat intelligence report documents the Russian state-nexus actor Midnight Blizzard using Claude to automatically monitor, modify, and redeploy malware until it evaded security products. The campaign hit more than 20 organizations, including Ukrainian and European government ministries, defense bodies, embassies, and think tanks, with mailbox theft from two drone component manufacturers and compromise of hotel guest Wi-Fi via DNS hijacking. The report also describes financially motivated groups GTG-50020 and GTG-50021 targeting AI credentials, including a prompt-injection attack on an automated evaluation sandbox that yielded production API keys and attempts to reach a pre-release Claude model across roughly 30 AI companies.
85
57
60
45
57
42
60
57
42
57
57
60
60