CaptiveCrunch is an ongoing global cyber espionage campaign attributed to Storm-2945, an operational sub-cluster of the Russia-based threat actor Midnight Blizzard (APT29 / Cozy Bear), which is attributed by US and UK governments to the Foreign Intelligence Service of the Russian Federation (SVR). First tracked by Microsoft since February 2026 and observed in its captive-portal form since early May 2026, the campaign represents a significant evolution in adversary-in-the-middle (AitM) attacks at scale, combining physical-network compromise with sophisticated OAuth credential theft and custom malware delivery.

Attack Methodology: The threat actor gains administrative access to internet-facing captive portal gateway appliances at hotels, conference centers, and shared venues. The initial compromise vector remains under investigation, but Microsoft found notable commonalities in equipment and management systems across affected networks, suggesting potential access to shared services within the captive portal ecosystem rather than isolated compromises. ReliaQuest assesses with low-to-medium confidence that initial access likely exploited exposed management interfaces (including internet-facing SSH, SNMP, and web administration consoles) in combination with weak or reused administrative credentials. Once in control, the attackers modify DNS and HTTP traffic so that all DNS requests from guests connected to the network resolve to actor-controlled IP addresses. This approach bypasses common DNS protections because hard-coded resolvers like 8.8.8.8 still send unencrypted requests the gateway can forge, and opportunistic-mode encrypted DNS permits plaintext fallback. In approximately one-third of observed cases, the attackers also abused Web Proxy Auto-Discovery (WPAD) by controlling DHCP option 252 or DNS lookups for 'wpad', enabling deployment of malicious proxy auto-configuration (PAC) files that route application traffic through attacker proxies.

From this AitM position, the attackers redirect users through actor-controlled phishing infrastructure using ClickFix (fake verification/update pages) that present fake browser update prompts, Windows Driver Repair utilities, Google-branded verification checks, and other social engineering lures. Users are directed either to malware downloads or to device code authentication flows.

Malware Arsenal: CornFlake is a full-featured Windows remote access trojan written in Go, serving as the primary persistent implant. It uses ECDH P-256 ephemeral key exchange for C2 encryption with session keys derived via SHA-256 over a custom JSON protocol. On execution, it operates in dropper mode displaying a fake progress window, copies itself to %APPDATA%\svchost32\svchost32.exe, and establishes redundant persistence via Windows service creation (svchost32 / 'Cloud Sync Service'), Registry Run keys, and scheduled tasks with a continuous watchdog. Capabilities include raw-input keylogging, clipboard monitoring with SHA-256 deduplication, idle-triggered and on-demand screenshots, WASAPI-based microphone capture, Media Foundation-based webcam capture, ChromeKatz-derived browser credential theft (supporting Chrome ABE bypass for v127+ and Firefox NSS/SDR decryption), real-time filesystem exfiltration (throttled at 1,000 files or 500 MB per cycle), USB removable media scanning, security posture enumeration across 18 categories, and remote shell via cmd.exe or PowerShell. It also exposes a localhost HTTP API server with /upload, /reload, and /status endpoints allowing companion payloads to task file exfiltration or trigger config reloads. ChocoShell is a PowerShell-based infostealer executed entirely in-memory, targeting high-volume theft of browser session cookies, saved passwords, Microsoft 365 SSO tokens, and Wi-Fi credentials. It communicates with a hardcoded C2 at 213.145.86.112 via HTTPS beacons disguised as tracking pixels (/t/pixel.gif?m=<status>) and fetches tooling from paths like /cdn/chunks/polyfill-7e2b.min.js masquerading as JavaScript polyfills. ChocoShell disables AMSI via .NET reflection, implements timing-based sandbox detection, and uses three ordered UAC bypass techniques: SilentCleanup task hijack (HKCU\Environment\windir), wsreset.exe COM hijack (HKCU\Software\Classes), and sdclt.exe folder hijack (HKCU\Software\Classes\Folder\shell\open\command), with fallback to a visible UAC prompt. For credential extraction, it handles both modern Chrome ABE encryption (v127+, requiring SYSTEM-level DPAPI access) and legacy DPAPI-only schemes, and includes a parallel collection path using Chrome DevTools Protocol's Network.getAllCookies to bypass ABE entirely. FruitStone is a web-based C2 panel branded as 'CloudSync Console / Acuity Systems, Inc. — Cloud Infrastructure Portal v3.2.1', exposing JWT-authenticated multi-operator access, agent dashboards with SSE real-time status, geographic distribution mapping, remote shell access, filesystem browsing, collection tasking, implant configuration, and a campaign builder for configuring dropper types, evasion settings, and proxy relay management.

Device Code OAuth Theft: Since July 16, 2026, portions of CaptiveCrunch landing pages redirect users to Microsoft Entra ID device code authentication flows. This technique, previously associated with Storm-2372 (another Midnight Blizzard sub-cluster tracked since August 2024), exploits the legitimate OAuth device authorization workflow designed for input-constrained devices. The attacker generates a device code via Microsoft's OAuth endpoint, then tricks the user into entering that code at login.microsoftonline.com. When the victim authenticates with MFA, they authorize the attacker's session rather than their own, granting the attacker persistent access tokens to the victim's Microsoft 365 account. This bypasses MFA entirely because Microsoft issues valid OAuth tokens to the attacker-controlled client. Device codes expire after 15 minutes, requiring real-time coordination. Forensic traces include authenticationProtocol: deviceCode in Entra ID sign-in logs and originalTransferMethod: deviceCodeFlow in subsequent session refreshes.

Targeting Scope: Compromised gateways identified across multiple US cities, India, Saudi Arabia, and worldwide locations. Affected sectors observed in traffic include financial services, professional services, legal, healthcare, energy, retail, government, diplomatic entities, NGOs, and IT service providers. The campaign is assessed as not sector-specific but rather targeting traveling employees wherever they connect. Any captive portal operator faces similar risk, including airports, conference centers, coworking spaces, universities, and event venues. The campaign also exploits AI-augmented operations, with Microsoft noting Storm-2945 leverages AI to support a significant portion of these operations.

Microsoft Threat Intelligence has tracked Storm-2945 since February 2026, with Storm-2945 overlapping with Storm-2372, a previous Midnight Blizzard sub-cluster known for device code and OAuth code phishing tracked throughout 2025, Microsoft Graph-based email exfiltration, and social engineering via commercial messaging apps. The CaptiveCrunch campaign shares TTP overlap with the Forest Blizzard (APT28 / GRU) FrostArmada DNS hijacking campaign disclosed in April 2026 but uses distinct infrastructure, indicating separate SVR operations.