# CaptiveCrunch: Storm-2945 (Midnight Blizzard sub-cluster) Hijacks Hotel Wi-Fi Captive Portals to Deliver CornFlake RAT and Steal Microsoft 365 Tokens

> Storm-2945, an operational sub-cluster of Russian SVR-linked Midnight Blizzard (APT29/Cozy Bear), has since early May 2026 compromised hospitality captive-portal gateways to forge DNS responses and push fake Windows/browser update pages that deliver the Go-based CornFlake RAT and the in-memory ChocoShell PowerShell infostealer, harvesting Microsoft 365/Entra ID tokens from corporate travelers to bypass MFA. Since July 16, 2026 the campaign has added device-code OAuth phishing via doppelganger Microsoft domains.

- **Published:** 2026-07-31T00:00:00Z
- **Last reviewed:** 2026-10-08T12:01:43.739Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1808
- **ID:** TL-2026-1808
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** Storm-2945 (Russia)
- **Detections:** 9 · **IOCs:** 31 (full data via the Threadlinqs MCP server — Purple tier)

## Description

CaptiveCrunch is a network-level initial-access campaign in which Storm-2945 operators obtain administrative control of hotel, conference-center, and shared-venue captive-portal gateways/appliances -- ReliaQuest assesses with low-to-medium confidence via exposed internet-facing SSH, SNMP, and web administration consoles combined with weak or reused administrator credentials. Because these gateways also serve as the DHCP-assigned DNS resolver for connected devices, the actor forges DNS answers for the victim's automatic connectivity-check domains and Microsoft authentication domains, redirecting traffic to attacker infrastructure even when the endpoint is configured to use a public resolver such as 8.8.8.8 (the request still leaves the device in plaintext and is forged in transit). In roughly one-third of observed incidents the actor additionally abuses Web Proxy Auto-Discovery (WPAD, via DHCP option 252 or DNS 'wpad' lookups) to route all Windows application traffic through an attacker-controlled proxy.

Victims are shown configurable ClickFix-style fake progress/verification pages (Windows Update, Windows Security/Defender scan, Google verification, DirectX installer, Visual C++ redistributable, disk optimizer, network diagnostics, browser update, PDF viewer) that socially engineer the user into pasting and executing a command that installs CornFlake, a full-featured Go-based RAT that copies itself to %APPDATA%\svchost32\svchost32.exe and registers as the Windows service 'svchost32' (display name 'Cloud Sync Service', description 'Synchronizes files with the cloud storage provider'), reinforced with an HKCU Run-key entry and a scheduled task, each restored by a watchdog routine if removed. CornFlake negotiates its C2 channel via ECDH P-256 ephemeral key exchange with SHA-256 session-key derivation and a custom JSON protocol, is hot-reconfigurable via a local sync.dat file, and exposes a localhost API (/upload, /reload, /status). Its collection modules include Raw-Input-API keylogging (including password fields), SHA-256-deduplicated clipboard capture with active-window-title context, idle-triggered and on-demand screenshots, WASAPI microphone capture, Media Foundation webcam capture, a ChromeKatz-derived module that defeats Chrome App-Bound Encryption plus Firefox NSS/SDR cookie and password decryption, extension-filtered file exfiltration (throttled to 1,000 files/500MB per cycle), removable-media scanning, an 18-category system/security-posture survey, and an interactive cmd.exe/PowerShell remote shell.

Where the operators want cloud-token access specifically, they deploy ChocoShell, an in-memory PowerShell infostealer executed via [ScriptBlock]::Create() that beacons over HTTPS to a hardcoded C2 (213.145.86.112) using a tracking-pixel-styled path (/t/pixel.gif?m=<status>), fetches follow-on payloads disguised as a JS polyfill (/cdn/chunks/polyfill-7e2b.min.js), and exfiltrates GZip-compressed, Base64-wrapped JSON to /t/event. ChocoShell tampers with AMSI via .NET reflection, performs a timing-based sandbox/VM check with a silent exit, and chains three silent UAC-bypass techniques with a visible-prompt fallback: a SilentCleanup scheduled-task hijack via HKCU\Environment\windir (with a 2-second registry cleanup to dodge cloud detection), a wsreset.exe auto-elevation COM hijack via HKCU\Software\Classes, and an sdclt.exe folder-hijack via HKCU\Software\Classes\Folder\shell\open\command using the /KickOffElev flag. Once elevated it disables Windows Defender signatures, extracts the Chromium 'Local State' master key (handling both legacy DPAPI and Chrome v127+ App-Bound Encryption via SYSTEM-level token impersonation from winlogon.exe/wininit.exe/services.exe, or by launching Chrome with --remote-debugging-port and calling the Chrome DevTools Protocol's Network.getAllCookies to bypass ABE entirely), copies unencrypted cookies.sqlite from Firefox-family browsers, harvests Wi-Fi credentials via 'netsh wlan show profile key=clear', and -- most notably -- pulls Microsoft 365/Azure AD access, refresh, and Web Account Manager (WAM) tokens from .tbres files in the local Token Broker cache, enabling SSO session replay without ever touching a browser cookie. It finishes by deleting VSS shadow copies via WMI and scrubbing its own elevation artifacts.

All compromised endpoints are managed through FruitStone, a JWT-authenticated, multi-operator web C2 panel branded as 'CloudSync Console' (footer: 'Acuity Systems, Inc. -- Cloud Infrastructure Portal v3.2.1') with per-operator sessions, IP-based rate limiting, a real-time Server-Sent-Events agent dashboard (host/user/OS/hardware/geo/domain-membership/camera-mic presence, grouped by country and subnet on a map), a campaign-builder wizard (C dropper ~19KB / Go stub ~8MB / standalone installer, toggleable capability modules, configurable exfil file-path categories, Garble symbol randomization plus XOR/GZip evasion), and infrastructure management for TLS-tracked proxy relays, beacon sleep/jitter profiles with TLS-SNI spoofing (e.g., teams.microsoft.com), DNS fallback domains, and push-to-deploy staging servers.

Since July 16, 2026 the same captive-portal foothold has also been used to funnel victims into device-code/OAuth phishing: the victim is directed to enter an attacker-supplied device code on Microsoft's own legitimate sign-in page, after which Entra ID issues valid, MFA-satisfied OAuth tokens directly to the attacker-controlled client -- no credentials or session cookies are ever touched. A companion operator panel at ms365-device.com lets the actor upload lure pages, rotate infrastructure, IP-allowlist access, and track visitor telemetry. Microsoft attributes CaptiveCrunch to Storm-2945 based on technical overlap with Storm-2372 (the device-code/OAuth-phishing sub-cluster), Microsoft-Graph-based email exfiltration, and shared victimology with Midnight Blizzard/APT29, itself attributed by the US and UK governments to Russia's SVR foreign intelligence service; Microsoft also states Storm-2945 is using AI to generate a significant portion of its tooling, evidenced by verbose developer comments embedded in ChocoShell that explicitly reference Microsoft detection signatures. ReliaQuest separately notes gateway-level DNS-poisoning tradecraft overlapping with 'FrostArmada,' an April 2026 campaign attributed to APT28/Forest Blizzard (Russian GRU), though it assesses CaptiveCrunch as less sophisticated and running on distinct infrastructure -- either a different actor reusing the tradecraft or a deliberate operational shift. Confirmed victim traffic spans financial services, professional services, legal, healthcare, energy, and retail organizations across the US, India, and Saudi Arabia, consistent with opportunistic targeting of any traveling employee rather than a single vertical.

## MITRE ATT&CK

- T1566.002 Spearphishing Link
- T1566.004 Spearphishing Voice
- T1195.003 Compromise Hardware Supply Chain
- T1584.006 Web Services
- T1583.001 Domains
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1204.001 Malicious Link
- T1204.002 Malicious File
- T1543.003 Windows Service
- T1547.001 Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task
- T1547.014 Active Setup
- T1134.003 Make and Impersonate Token
- T1548.002 Bypass User Account Control
- T1685 Disable or Modify Tools
- T1112 Modify Registry
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1218.007 Msiexec
- T1550.004 Web Session Cookie
- T1555.003 Credentials from Web Browsers
- T1056.001 Keylogging
- T1528 Steal Application Access Token
- T1087 Account Discovery
- T1010 Application Window Discovery
- T1580 Cloud Infrastructure Discovery
- T1518.001 Security Software Discovery
- T1082 System Information Discovery
- T1123 Audio Capture
- T1125 Video Capture
- T1113 Screen Capture
- T1115 Clipboard Data
- T1119 Automated Collection
- T1020 Automated Exfiltration
- T1041 Exfiltration Over C2 Channel
- T1071.001 Web Protocols
- T1573.002 Asymmetric Cryptography
- T1090 Proxy
- T1531 Account Access Removal

## Sources

- [CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft](https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/)
- [DNS Poisoning Tactics Expand to Hospitality Wi-Fi](https://reliaquest.com/blog/threat-spotlight-dns-poisoning-tactics-expand-to-hospitality/)
- [Russian hackers hijack hotel Wi-Fi to steal Microsoft 365 tokens](https://securityaffairs.com/196441/apt/russian-hackers-hijack-hotel-wi-fi-to-steal-microsoft-365-tokens.html)
- [Hijacked Hotel Wi-Fi Pushes Fake Updates to Deliver Surveillance Malware](https://thehackernews.com/2026/08/hijacked-hotel-wi-fi-pushes-fake.html)
- [Hacked Public Wi-Fi Gateways Used to Harvest Corporate Credentials](https://www.securityweek.com/hacked-public-wi-fi-gateways-used-to-harvest-corporate-credentials/)
- [CaptiveCrunch: Midnight Blizzard Targets Travelers Worldwide For Malware Delivery And Credential Theft](https://www.arrowwoodservices.com/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/)
- [Hotel Wi-Fi Gateways Weaponized to Steal Microsoft 365 Logins: MFA Bypassed](https://www.techtimes.com/articles/321566/20260725/hotel-wi-fi-gateways-weaponized-steal-microsoft-365-logins-mfa-bypassed.htm)
- [Microsoft Issues Hotel Wi-Fi Warning For Windows PC Users](https://tech.yahoo.com/cybersecurity/articles/microsoft-issues-hotel-wi-fi-125650555.html)
- [Hijacked Hotel Wi-Fi Pushes Fake Updates to Deliver Surveillance Malware](https://nuclearcoffee.org/hijacked-hotel-wi-fi-pushes-fake-updates-to-deliver-surveillance-malware/)
- [ReliaQuest Uncovers Widespread DNS Poisoning Campaign Targeting Hotel and Conference Wi-Fi Gateways for Microsoft 365 Credential Theft](https://www.brinztech.com/breach-alerts/brinztech-alert-reliaquest-uncovers-widespread-dns-poisoning-campaign-targeting-hotel-and-conference-wi-fi-gateways-for-microsoft-365-credential-theft)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1808