This vulnerability (CVE-2026-21509) is classified as CWE-807, indicating reliance on untrusted inputs in a security decision within Microsoft 365 Apps for Enterprise. The threat actors manipulate captive portal networks to redirect users to attacker-controlled infrastructure, enabling credential theft through phishing and malware. The campaign deploys CornFlake RAT and ChocoShell PowerShell stealer to gain persistent access and harvest sensitive credentials including Microsoft 365 and Azure AD tokens. The attack targets multiple sectors and regions, exploiting device code phishing and social engineering techniques. Microsoft has issued an official fix for this vulnerability, and it affects version 16.0.1 of Microsoft 365 Apps for Enterprise. The vulnerability has a CVSS 3.1 score of 7.8 (high severity) and is a cloud service vulnerability with no known exploits in the wild at this time.

Successful exploitation allows attackers to steal Microsoft 365 credentials and tokens, enabling unauthorized access to enterprise resources. The malware tools deployed provide persistent access and extensive surveillance capabilities, potentially leading to data theft and further compromise. The campaign targets travelers using captive portal networks, affecting multiple sectors and geographic regions. The impact includes confidentiality, integrity, and availability losses rated high according to CVSS metrics.

An official fix is available from Microsoft for this vulnerability. Since this is a cloud service vulnerability, Microsoft manages remediation server-side. Users and administrators should apply the official updates as directed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509. No additional mitigation steps are specified beyond applying the official fix.