CaptiveCrunch: Midnight Blizzard Uses Hotel Wi-Fi to Steal M365 OAuth Tokens
Microsoft Threat Intelligence (MSTIC) has documented a Russian state campaign, tracked as CaptiveCrunch and attributed to Midnight Blizzard (SVR), that exploits hotel captive portal mechanisms to intercept Microsoft 365 OAuth tokens. The campaign targets government and defense sector employees traveling internationally and authenticating to M365 over hotel Wi-Fi.
How the attack works
When a traveler connects to a hotel network, the network typically redirects HTTP traffic to a captive portal page before granting internet access. CaptiveCrunch inserts a malicious redirect into this flow. The attacker, operating hardware on or adjacent to the hotel network, serves a convincing Microsoft login page at the portal redirect step.
The more sophisticated variant observed by MSTIC intercepts the OAuth authorization code issued by Microsoft's identity provider rather than harvesting a plaintext password. Because OAuth codes are intended for one-time use and expire quickly, the attacker's infrastructure exchanges the code for a bearer token within seconds of capture, before the legitimate application can consume it.
The resulting token grants persistent access to the victim's M365 environment, including Exchange Online, Teams, and SharePoint, without requiring the victim's password again. M365 access token lifetimes can reach 24 hours, with refresh tokens extending usable access further.
Target profile and operational patience
MSTIC assessed that CaptiveCrunch targets personnel with access to sensitive government and defense information, prioritizing individuals traveling to European capitals and international conference venues. Midnight Blizzard has maintained sustained interest in diplomatic and foreign policy material consistent with the SVR's intelligence collection mandate.
The campaign is notable for its operational patience. MSTIC observed captured tokens being used hours to days after initial theft, suggesting the actor reviews harvested sessions selectively rather than automating bulk exploitation.
Defensive measures
The most effective single control is Continuous Access Evaluation (CAE), which allows M365 to revoke tokens in near real time when policy conditions change, reducing the window of usability for intercepted tokens from hours to seconds. CAE is enabled by default in current Exchange Online and Teams clients.
Additional controls that reduce exposure:
- Require compliant or hybrid-joined devices for M365 access, blocking token use from unregistered endpoints.
- Configure Conditional Access policies that flag sign-ins from unfamiliar geographies for step-up authentication.
- Enable sign-in risk policies in Microsoft Entra ID so anomalous token use triggers re-authentication.
- Instruct personnel to use a cellular data connection or a managed VPN before authenticating to any cloud service when traveling.
CaptiveCrunch is a reminder that cloud credential security does not end at the corporate perimeter. Network environment, token validation policies, and device posture checks matter most precisely when users step outside familiar infrastructure.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you are evaluating cloud identity security or M365 tenant hardening.