Midnight Blizzard Exploits Outlook XSS Flaw CVE-2026-42897
Russian Group Midnight Blizzard Exploits Outlook XSS Flaw (CVE-2026-42897)
Related Entities(initial)
Threat Actors
Organizations
Products & Tech
Other
CVE Identifiers
Full Report(when first published)
Executive Summary
The Russian state-affiliated threat actor Midnight Blizzard (also tracked as Storm-2945 and APT29) is conducting a multi-pronged espionage campaign targeting organizations in the United States and Europe. The group is exploiting CVE-2026-42897, a cross-site scripting (XSS) vulnerability in Microsoft Outlook Web Access (OWA), to gain persistent access to victim mailboxes. Concurrently, in a campaign dubbed 'CaptiveCrunch,' the same actor is compromising hotel and conference center Wi-Fi captive portals to intercept traffic, deploy malware, and steal Microsoft 365 and Azure AD authentication tokens from high-value targets. This dual approach demonstrates the actor's sophistication in leveraging both software vulnerabilities and physical-world infrastructure to achieve its objectives.
Threat Overview
Actor: Midnight Blizzard is a well-known Russian intelligence-linked group focused on long-term espionage and data theft.
Targets: The campaigns are aimed at a wide range of sectors, including government, telecommunications, financial services, hospitality, and aerospace.
Objectives: The primary goal is to gain and maintain persistent access to sensitive information within victim environments, particularly email communications and cloud-based data.
Technical Analysis
Midnight Blizzard is employing two distinct but related attack chains:
OWA Exploitation
- Vulnerability: The actor is weaponizing CVE-2026-42897 (CVSS: 8.1), an XSS flaw in OWA. Exploitation allows the actor to execute arbitrary scripts in the context of the victim's browser session, enabling mailbox access and data exfiltration.
- Timeline: While the main campaign activity was observed starting around July 22, 2026, Microsoft reports that exploitation of this vulnerability dates back to as early as May 2026.
'CaptiveCrunch' Campaign
- Initial Access: The attackers compromise the infrastructure serving Wi-Fi captive portals at hotels and conference centers frequented by their targets. This is a form of Man-in-the-Middle attack.
- Execution: By manipulating DNS and HTTP traffic, they trick users into downloading malicious payloads disguised as legitimate software or updates.
- Malware: Two custom malware families,
CornFlakeandChocoShell, are used. These are likely backdoors or info-stealers designed to harvest credentials and session tokens. - Credential Access: The primary goal of this TTP is to steal Microsoft 365 and Azure AD authentication tokens. Stolen tokens allow the actor to bypass multi-factor authentication and gain direct access to cloud accounts.
This activity maps to the following MITRE ATT&CK techniques:
T1059.007 - JavaScript/JScript: Used in the exploitation of the OWA XSS vulnerability.T1557 - Man-in-the-Middle: The core technique of the 'CaptiveCrunch' campaign.T1189 - Drive-by Compromise: How malware is delivered via the compromised captive portals.T1539 - Steal Web Session Cookie: The objective of harvesting M365/Azure AD tokens.
Impact Assessment
Successful exploitation grants Midnight Blizzard significant access to sensitive organizational data. The theft of authentication tokens is particularly damaging as it allows attackers to impersonate legitimate users and bypass MFA, making detection difficult. This access can be used for long-term intelligence gathering, exfiltration of intellectual property, and gaining a foothold for broader network intrusions.
IOCs — Directly from Articles
No specific Indicators of Compromise (IOCs) were provided in the source articles.
Cyber Observables — Hunting Hints
Security teams may want to hunt for the following patterns:
CornFlake, ChocoShell (if specific process names become known)Detection & Response
- Log Analysis: Review OWA and web proxy logs for evidence of XSS exploitation attempts against CVE-2026-42897. Monitor Azure AD sign-in logs for suspicious session token usage, such as logins from multiple geographic locations in a short time frame.
- Endpoint Security: Deploy EDR solutions capable of detecting and blocking the
CornFlakeandChocoShellmalware families. - User Training: Educate high-risk employees, especially frequent travelers, about the dangers of using public Wi-Fi and the tactics of captive portal hijacking.
Mitigation
- Patch OWA: Immediately apply the security updates from Microsoft that address CVE-2026-42897.
- Use VPNs: Mandate the use of a corporate VPN for all employees when connecting to any untrusted network, including hotel and public Wi-Fi.
- Conditional Access Policies: Implement strict Azure AD Conditional Access policies that scrutinize login attempts based on device compliance, location, and risk level. This can help invalidate or block the use of stolen session tokens.
- Token Protection: Leverage token protection features in modern identity systems to bind tokens to specific devices or network sessions, making them harder to reuse if stolen.
Timeline of Events
Article Updates
August 4, 2026
New details emerge on Midnight Blizzard's 'CaptiveCrunch' campaign, detailing how hotel Wi-Fi gateways are compromised via DNS manipulation for AitM attacks to steal M365 tokens.
New intelligence provides a deeper dive into Midnight Blizzard's 'CaptiveCrunch' campaign. The threat actor compromises public Wi-Fi gateways, likely via vulnerabilities or weak credentials, to modify DNS settings. This enables Adversary-in-the-Middle (AitM) attacks, redirecting users to attacker-controlled servers to intercept Microsoft 365 and Azure AD authentication tokens, bypassing MFA. The campaign utilizes CornFlake and ChocoShell malware. New MITRE ATT&CK mappings include T1190, T1078, and T1562.007, alongside D3FEND techniques for detection and mitigation. This update emphasizes the critical need for VPNs and phishing-resistant MFA when using public networks.
Update Sources:
Timeline of Events
Microsoft indicates that exploitation of CVE-2026-42897 began as early as May 2026.
A broader campaign leveraging the OWA vulnerability was observed to have begun.
Sources & References(when first published)
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.