Threat reportAPTTL-2026-1808

CaptiveCrunch: Storm-2945 (Midnight Blizzard sub-cluster) Hijacks Hotel Wi-Fi Captive Portals to Deliver CornFlake RAT and Steal Microsoft 365 Tokens

highACTIVE

CaptiveCrunch (TL-2026-1808), also tracked as CaptiveCrunch, is a high-severity advanced persistent threat campaign, first published 2026-07-31 and last reviewed 2026-10-08. It is attributed to Storm-2945 (Russia) with high confidence, affects Microsoft Windows, maps to 64 MITRE ATT&CK techniques (T1005, T1010, T1020), and is covered by 9 detection rules and 31 indicators of compromise.

Severity
HIGHAssessed severity
CVEs
0None referenced
Techniques
64MITRE ATT&CK
Actors
1Storm-2945
Detection rules
9SPL · KQL · Sigma
IOCs
31Indicators of compromise

Key facts for TL-2026-1808

Threat ID
TL-2026-1808
Also known as
CaptiveCrunch
Severity
HIGH
Status
ACTIVE
Category
APT
First published
Last reviewed
Attribution
Storm-2945
Attribution confidence
HIGH
Nation-state nexus
Russia
Motivation
ESPIONAGE
Target sectors
hospitality, financial-services, professional-services, legal, health, energy, retail
Target regions
united states of america, india, saudi arabia, Global
Detection rules
9
Indicators of compromise
31
Updates
2026-10-08 · 4 updates · revalidated 4× · latest source

Malware and tooling in CaptiveCrunch

Malware and tooling: ChocoShell, CornFlake, FruitStone, FruitStone beacon TLS-SNI spoofing teams.microsoft.com

How CaptiveCrunch works

Storm-2945, an operational sub-cluster of Russian SVR-linked Midnight Blizzard (APT29/Cozy Bear), has since early May 2026 compromised hospitality captive-portal gateways to forge DNS responses and push fake Windows/browser update pages that deliver the Go-based CornFlake RAT and the in-memory ChocoShell PowerShell infostealer, harvesting Microsoft 365/Entra ID tokens from corporate travelers to bypass MFA. Since July 16, 2026 the campaign has added device-code OAuth phishing via doppelganger Microsoft domains.

CaptiveCrunch is a network-level initial-access campaign in which Storm-2945 operators obtain administrative control of hotel, conference-center, and shared-venue captive-portal gateways/appliances -- ReliaQuest assesses with low-to-medium confidence via exposed internet-facing SSH, SNMP, and web administration consoles combined with weak or reused administrator credentials. Because these gateways also serve as the DHCP-assigned DNS resolver for connected devices, the actor forges DNS answers for the victim's automatic connectivity-check domains and Microsoft authentication domains, redirecting traffic to attacker infrastructure even when the endpoint is configured to use a public resolver such as 8.8.8.8 (the request still leaves the device in plaintext and is forged in transit). In roughly one-third of observed incidents the actor additionally abuses Web Proxy Auto-Discovery (WPAD, via DHCP option 252 or DNS 'wpad' lookups) to route all Windows application traffic through an attacker-controlled proxy.

Victims are shown configurable ClickFix-style fake progress/verification pages (Windows Update, Windows Security/Defender scan, Google verification, DirectX installer, Visual C++ redistributable, disk optimizer, network diagnostics, browser update, PDF viewer) that socially engineer the user into pasting and executing a command that installs CornFlake, a full-featured Go-based RAT that copies itself to %APPDATA%\svchost32\svchost32.exe and registers as the Windows service 'svchost32' (display name 'Cloud Sync Service', description 'Synchronizes files with the cloud storage provider'), reinforced with an HKCU Run-key entry and a scheduled task, each restored by a watchdog routine if removed. CornFlake negotiates its C2 channel via ECDH P-256 ephemeral key exchange with SHA-256 session-key derivation and a custom JSON protocol, is hot-reconfigurable via a local sync.dat file, and exposes a localhost API (/upload, /reload, /status). Its collection modules include Raw-Input-API keylogging (including password fields), SHA-256-deduplicated clipboard capture with active-window-title context, idle-triggered and on-demand screenshots, WASAPI microphone capture, Media Foundation webcam capture, a ChromeKatz-derived module that defeats Chrome App-Bound Encryption plus Firefox NSS/SDR cookie and password decryption, extension-filtered file exfiltration (throttled to 1,000 files/500MB per cycle), removable-media scanning, an 18-category system/security-posture survey, and an interactive cmd.exe/PowerShell remote shell.

Where the operators want cloud-token access specifically, they deploy ChocoShell, an in-memory PowerShell infostealer executed via [ScriptBlock]::Create() that beacons over HTTPS to a hardcoded C2 (213.145.86.112) using a tracking-pixel-styled path (/t/pixel.gif?m=<status>), fetches follow-on payloads disguised as a JS polyfill (/cdn/chunks/polyfill-7e2b.min.js), and exfiltrates GZip-compressed, Base64-wrapped JSON to /t/event. ChocoShell tampers with AMSI via .NET reflection, performs a timing-based sandbox/VM check with a silent exit, and chains three silent UAC-bypass techniques with a visible-prompt fallback: a SilentCleanup scheduled-task hijack via HKCU\Environment\windir (with a 2-second registry cleanup to dodge cloud detection), a wsreset.exe auto-elevation COM hijack via HKCU\Software\Classes, and an sdclt.exe folder-hijack via HKCU\Software\Classes\Folder\shell\open\command using the /KickOffElev flag. Once elevated it disables Windows Defender signatures, extracts the Chromium 'Local State' master key (handling both legacy DPAPI and Chrome v127+ App-Bound Encryption via SYSTEM-level token impersonation from winlogon.exe/wininit.exe/services.exe, or by launching Chrome with --remote-debugging-port and calling the Chrome DevTools Protocol's Network.getAllCookies to bypass ABE entirely), copies unencrypted cookies.sqlite from Firefox-family browsers, harvests Wi-Fi credentials via 'netsh wlan show profile key=clear', and -- most notably -- pulls Microsoft 365/Azure AD access, refresh, and Web Account Manager (WAM) tokens from .tbres files in the local Token Broker cache, enabling SSO session replay without ever touching a browser cookie. It finishes by deleting VSS shadow copies via WMI and scrubbing its own elevation artifacts.

All compromised endpoints are managed through FruitStone, a JWT-authenticated, multi-operator web C2 panel branded as 'CloudSync Console' (footer: 'Acuity Systems, Inc. -- Cloud Infrastructure Portal v3.2.1') with per-operator sessions, IP-based rate limiting, a real-time Server-Sent-Events agent dashboard (host/user/OS/hardware/geo/domain-membership/camera-mic presence, grouped by country and subnet on a map), a campaign-builder wizard (C dropper ~19KB / Go stub ~8MB / standalone installer, toggleable capability modules, configurable exfil file-path categories, Garble symbol randomization plus XOR/GZip evasion), and infrastructure management for TLS-tracked proxy relays, beacon sleep/jitter profiles with TLS-SNI spoofing (e.g., teams.microsoft.com), DNS fallback domains, and push-to-deploy staging servers.

Since July 16, 2026 the same captive-portal foothold has also been used to funnel victims into device-code/OAuth phishing: the victim is directed to enter an attacker-supplied device code on Microsoft's own legitimate sign-in page, after which Entra ID issues valid, MFA-satisfied OAuth tokens directly to the attacker-controlled client -- no credentials or session cookies are ever touched. A companion operator panel at ms365-device.com lets the actor upload lure pages, rotate infrastructure, IP-allowlist access, and track visitor telemetry. Microsoft attributes CaptiveCrunch to Storm-2945 based on technical overlap with Storm-2372 (the device-code/OAuth-phishing sub-cluster), Microsoft-Graph-based email exfiltration, and shared victimology with Midnight Blizzard/APT29, itself attributed by the US and UK governments to Russia's SVR foreign intelligence service; Microsoft also states Storm-2945 is using AI to generate a significant portion of its tooling, evidenced by verbose developer comments embedded in ChocoShell that explicitly reference Microsoft detection signatures. ReliaQuest separately notes gateway-level DNS-poisoning tradecraft overlapping with 'FrostArmada,' an April 2026 campaign attributed to APT28/Forest Blizzard (Russian GRU), though it assesses CaptiveCrunch as less sophisticated and running on distinct infrastructure -- either a different actor reusing the tradecraft or a deliberate operational shift. Confirmed victim traffic spans financial services, professional services, legal, healthcare, energy, and retail organizations across the US, India, and Saudi Arabia, consistent with opportunistic targeting of any traveling employee rather than a single vertical.

MITRE ATT&CK techniques used in TL-2026-1808

Collection

T1005 Data from Local System; T1113 Screen Capture; T1114 Email Collection; T1115 Clipboard Data; T1119 Automated Collection; T1123 Audio Capture; T1125 Video Capture

Discovery

T1010 Application Window Discovery; T1082 System Information Discovery; T1087 Account Discovery; T1120 Peripheral Device Discovery; T1497 Virtualization/Sandbox Evasion; T1518.001 Security Software Discovery; T1580 Cloud Infrastructure Discovery

Exfiltration

T1020 Automated Exfiltration; T1041 Exfiltration Over C2 Channel

Defense Evasion

T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information; T1218.007 Msiexec; T1684.001 Impersonation

Persistence

T1053.005 Scheduled Task; T1543.003 Windows Service; T1547.001 Registry Run Keys / Startup Folder; T1547.014 Active Setup

Credential Access

T1056.001 Keylogging; T1111 Multi-Factor Authentication Interception; T1187 Forced Authentication; T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1552.001 Credentials In Files; T1555.003 Credentials from Web Browsers; T1557 Adversary-in-the-Middle

Execution

T1059.001 PowerShell; T1059.003 Windows Command Shell; T1204.001 Malicious Link; T1204.002 Malicious File; T1204.004 User Execution: Malicious Copy and Paste

Command and Control

T1071.001 Web Protocols; T1090 Proxy; T1105 Ingress Tool Transfer; T1132.001 Standard Encoding; T1573.002 Asymmetric Cryptography

Initial Access

T1078 Valid Accounts; T1189 Drive-by Compromise; T1195.003 Compromise Hardware Supply Chain; T1566.002 Spearphishing Link; T1566.004 Spearphishing Voice

defense-impairment

T1112 Modify Registry; T1685 Disable or Modify Tools

Privilege Escalation

T1134.001 Access Token Manipulation: Token Impersonation/Theft; T1134.003 Make and Impersonate Token; T1548.002 Bypass User Account Control

Impact

T1490 Inhibit System Recovery; T1531 Account Access Removal

lateral-movement

T1550.001 Application Access Token; T1550.004 Web Session Cookie

Resource Development

T1583.001 Domains; T1584.004 Server; T1584.006 Web Services; T1587.001 Malware; T1588.002 Tool

Reconnaissance

T1590 Gather Victim Network Information

Affected products and versions in CaptiveCrunch

  • Microsoft — Windows
    Vulnerable versions: all Windows versions where a user can be socially engineered into pasting/executing a command (ClickFix)
  • Microsoft — Microsoft 365 / Entra ID (Azure AD)
    Vulnerable versions: access, refresh, and Web Account Manager (WAM) tokens; device-code authentication flow
  • Google — Chrome and Chromium-based browsers (Edge, Brave, Opera, Opera GX, Vivaldi)
    Vulnerable versions: App-Bound Encryption (Chrome v127+) and legacy DPAPI-protected credential/cookie stores
  • Mozilla — Firefox and Firefox-family browsers (Waterfox, LibreWolf, Floorp, Zen)
    Vulnerable versions: NSS/SDR-encrypted cookies.sqlite profile stores

Remediation for CaptiveCrunch

Immediate actions

  • Block/monitor connectivity to known CaptiveCrunch infrastructure (IPs and domains listed in IOCs)
  • Reject software updates, certificates, drivers, or utilities presented by a captive portal or an unexpected browser prompt on any network
  • Block Microsoft Entra ID device-code authentication flow via Conditional Access where not operationally required; enforce strict Conditional Access where it must remain enabled
  • Hunt for the CornFlake install path (%APPDATA%\svchost32\svchost32.exe) and the 'svchost32'/'Cloud Sync Service' service registration across the fleet
  • Hunt for ChocoShell C2 traffic patterns (/t/pixel.gif?m=, /cdn/chunks/polyfill-7e2b.min.js, /t/event) and connections to 213.145.86.112
  • Isolate affected endpoints, disable compromised accounts, revoke active sessions, and delete the associated Entra ID device registrations

Workarounds

  • Prefer enterprise-managed travel routers, mobile hotspots, eSIM, or satellite connectivity instead of hospitality/conference-center Wi-Fi
  • Avoid disclosing corporate identity/affiliation/travel details during hotel Wi-Fi registration; never reuse corporate credentials on hospitality captive-portal registration pages

Longer-term hardening

  • Deploy always-on, full-tunnel corporate VPN so all DNS resolution (including system-level, non-browser queries) routes through trusted resolvers before reaching any untrusted gateway
  • Disable Web Proxy Auto-Discovery (WPAD) via Group Policy where not required, and monitor for unauthorized DHCP option 252 / 'wpad' DNS responses
  • Roll out passwordless authentication (FIDO2/passkeys with Microsoft Authenticator) and restrict MFA/passkey registration to trusted managed devices/locations
  • Deploy Security Service Edge / Global Secure Access to enforce corporate network posture on traveling devices
  • Prevent MDM-managed devices from auto-connecting to unprovisioned Wi-Fi networks (HKCU\Software\Microsoft\WLANSetting\Interfaces)
  • Deploy EDR/behavioral detection tuned for AMSI tampering, UAC-bypass chains (SilentCleanup/wsreset/sdclt), and Chrome App-Bound Encryption abuse via CDP debugging flags

Weaknesses (CWE) in CaptiveCrunch

CWE-290, CWE-306

Timeline of CaptiveCrunch

Showing the 20 most recent tracked events.

  • Storm-2372 shifts to abusing the Microsoft Authentication Broker client ID within the device code flow, enabling registration of actor-controlled devices in Entra ID and issuance of Primary Refresh Tokens -- the precursor technique later folded into CaptiveCrunch's device-code phishing.
  • Storm-2945 begins AI-augmented operations, laying groundwork for device-code/OAuth phishing tradecraft later folded into CaptiveCrunch.
  • IP 107.189.26.194 (ChocoShell C2 / compromised DNS-resolver infrastructure) first observed.
  • IP 104.194.159.150 (ms365-live.com hosting infrastructure) first observed.
  • Storm-2945 begins DNS/HTTP traffic manipulation from compromised hospitality captive-portal gateways worldwide (early May 2026).
  • ReliaQuest documents the DNS-poisoning campaign against hospitality Wi-Fi gateways as ongoing since at least June 2026.
  • IPs 38.146.28.75 and 213.145.86.112 (ChocoShell hardcoded C2 server) first observed.
  • CornFlake RAT sample (SHA256 918fa52a...e11c593) first observed.
  • ChocoShell infostealer sample (SHA256 be998574...970d8d42c) first observed.
  • Doppelganger domain ms365-live.com observed, used for device-code authentication flow abuse.
  • IP 38.146.28.132 (DNS-resolver/CaptiveCrunch infrastructure) confirmed active.
  • Device-code/OAuth phishing added to the CaptiveCrunch operation on domain owa-ms365.com; IP 31.57.243.154 observed.
  • Doppelganger domain m365-owa.com observed as an additional Microsoft 365 impersonation lure.
  • ReliaQuest publishes 'DNS Poisoning Tactics Expand to Hospitality Wi-Fi', publicly disclosing the campaign; operator panel domain ms365-device.com observed with content updated the same day.
  • Microsoft publishes the 'CaptiveCrunch' threat intelligence report formally attributing the campaign to Storm-2945, a Midnight Blizzard sub-cluster, noting AI-assisted tooling development.
  • The Hacker News and Security Affairs publish independent coverage corroborating Microsoft's CaptiveCrunch findings.
  • The Cyber Express publishes additional coverage of the CaptiveCrunch campaign.
  • SecurityWeek and other outlets publish coverage summarizing Microsoft's and ReliaQuest's nation-state attribution of CaptiveCrunch to Storm-2945.
  • Zscaler ThreatLabz publishes a technical analysis of CaptiveCrunch with IOCs, CornFlake/ChocoShell internals and detections (HTML.Phish.Microsoft.RZ, Win32.Downloader.ChocoShell.RZ); some ClickFix landing pages are reported to deliver an Android APK.
  • Gurucul publishes IOC-based detection queries for the CaptiveCrunch indicators.

Update history for TL-2026-1808

Sources cited for CaptiveCrunch

Detection coverage for TL-2026-1808

As of 2026-10-08, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1808 across Splunk SPL, Microsoft KQL and Sigma, covering 31 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

9 detection rules (Splunk SPL, Microsoft KQL, Sigma) · Blue and above. Compare plans
31 indicators of compromise · Red and above. Compare plans

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level
Fig. 01 · Threat weatherIndexing the archive…
1 square = 1 threat · click to open

Latest Threats