Midnight Blizzard uses hacked public Wi-Fi gateways to steal Microsoft accounts

Intelligence Summary

Midnight Blizzard is linked to credential theft campaigns targeting hospitality organizations. The activity involves compromised public Wi-Fi gateways that redirect or capture user authentication attempts. Victims’ Microsoft account credentials can be harvested and later misused for account takeover. This can expose email, cloud services, and other linked accounts to further compromise. Organizations offering guest Wi-Fi should review gateway security, segment networks, and monitor for suspicious authentication traffic.

Recommended Action

Review affected assets, schedule urgent remediation, and monitor related indicators.

Topics