Midnight Blizzard Exploits Outlook XSS Flaw CVE-2026-42897

Executive Summary

The Russian state-affiliated threat actor Midnight Blizzard (also tracked as Storm-2945 and APT29) is conducting a multi-pronged espionage campaign targeting organizations in the United States and Europe. The group is exploiting CVE-2026-42897, a cross-site scripting (XSS) vulnerability in Microsoft Outlook Web Access (OWA), to gain persistent access to victim mailboxes. Concurrently, in a campaign dubbed 'CaptiveCrunch,' the same actor is compromising hotel and conference center Wi-Fi captive portals to intercept traffic, deploy malware, and steal Microsoft 365 and Azure AD authentication tokens from high-value targets. This dual approach demonstrates the actor's sophistication in leveraging both software vulnerabilities and physical-world infrastructure to achieve its objectives.

Threat Overview

Actor: Midnight Blizzard is a well-known Russian intelligence-linked group focused on long-term espionage and data theft.

Targets: The campaigns are aimed at a wide range of sectors, including government, telecommunications, financial services, hospitality, and aerospace.

Objectives: The primary goal is to gain and maintain persistent access to sensitive information within victim environments, particularly email communications and cloud-based data.

Technical Analysis

Midnight Blizzard is employing two distinct but related attack chains:

OWA Exploitation

• Vulnerability: The actor is weaponizing CVE-2026-42897 (CVSS: 8.1), an XSS flaw in OWA. Exploitation allows the actor to execute arbitrary scripts in the context of the victim's browser session, enabling mailbox access and data exfiltration.
• Timeline: While the main campaign activity was observed starting around July 22, 2026, Microsoft reports that exploitation of this vulnerability dates back to as early as May 2026.

'CaptiveCrunch' Campaign

• Initial Access: The attackers compromise the infrastructure serving Wi-Fi captive portals at hotels and conference centers frequented by their targets. This is a form of Man-in-the-Middle attack.
• Execution: By manipulating DNS and HTTP traffic, they trick users into downloading malicious payloads disguised as legitimate software or updates.
• Malware: Two custom malware families, CornFlake and ChocoShell, are used. These are likely backdoors or info-stealers designed to harvest credentials and session tokens.
• Credential Access: The primary goal of this TTP is to steal Microsoft 365 and Azure AD authentication tokens. Stolen tokens allow the actor to bypass multi-factor authentication and gain direct access to cloud accounts.

This activity maps to the following MITRE ATT&CK techniques:

• T1059.007 - JavaScript/JScript: Used in the exploitation of the OWA XSS vulnerability.
• T1557 - Man-in-the-Middle: The core technique of the 'CaptiveCrunch' campaign.
• T1189 - Drive-by Compromise: How malware is delivered via the compromised captive portals.
• T1539 - Steal Web Session Cookie: The objective of harvesting M365/Azure AD tokens.

Impact Assessment

Successful exploitation grants Midnight Blizzard significant access to sensitive organizational data. The theft of authentication tokens is particularly damaging as it allows attackers to impersonate legitimate users and bypass MFA, making detection difficult. This access can be used for long-term intelligence gathering, exfiltration of intellectual property, and gaining a foothold for broader network intrusions.

IOCs — Directly from Articles

No specific Indicators of Compromise (IOCs) were provided in the source articles.

Cyber Observables — Hunting Hints

Security teams may want to hunt for the following patterns:

Detection & Response

1. Log Analysis: Review OWA and web proxy logs for evidence of XSS exploitation attempts against CVE-2026-42897. Monitor Azure AD sign-in logs for suspicious session token usage, such as logins from multiple geographic locations in a short time frame.
2. Endpoint Security: Deploy EDR solutions capable of detecting and blocking the CornFlake and ChocoShell malware families.
3. User Training: Educate high-risk employees, especially frequent travelers, about the dangers of using public Wi-Fi and the tactics of captive portal hijacking.

Mitigation

1. Patch OWA: Immediately apply the security updates from Microsoft that address CVE-2026-42897.
2. Use VPNs: Mandate the use of a corporate VPN for all employees when connecting to any untrusted network, including hotel and public Wi-Fi.
3. Conditional Access Policies: Implement strict Azure AD Conditional Access policies that scrutinize login attempts based on device compliance, location, and risk level. This can help invalidate or block the use of stolen session tokens.
4. Token Protection: Leverage token protection features in modern identity systems to bind tokens to specific devices or network sessions, making them harder to reuse if stolen.