# CaptiveCrunch: Russian SVR-Aligned Storm-2945 Hijacks Hotel Wi-Fi Captive Portals to Deploy CornFlake RAT and ChocoShell Info-Stealer Against Corporate Travelers

> Microsoft Threat Intelligence reports that Storm-2945, an operational sub-cluster of the Russia SVR-aligned Midnight Blizzard (APT29/Cozy Bear), has been compromising hotel and conference center Wi-Fi captive portals worldwide since at least early May 2026. The operation manipulates DNS/HTTP traffic on compromised networks to redirect corporate travelers to fake Microsoft 365 authentication pages for credential theft, abuses Microsoft's device-code authentication flow to obtain MFA-satisfied OAuth tokens, and delivers CornFlake (Go-based RAT) and ChocoShell (PowerShell info-stealer) via ClickFix-style fake browser/OS update lures. Android device targeting observed in some update page variants.

- **Published:** 2026-08-04T00:00:00Z
- **Last reviewed:** 2026-08-04T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1853
- **ID:** TL-2026-1853
- **Severity:** CRITICAL
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** UNC2452 (Russia)
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)

## Description

CaptiveCrunch is an active, AI-augmented espionage campaign conducted by Storm-2945, an operational sub-cluster of Midnight Blizzard (APT29/NOBELIUM), the threat actor attributed by the US and UK governments to the Russian Federation's Foreign Intelligence Service (SVR). Since at least early May 2026, the operators have been compromising captive portal Wi-Fi infrastructure at hotels, conference centers, and other shared venues worldwide and manipulating DNS and HTTP traffic to redirect connecting corporate travelers through actor-controlled infrastructure. The objective is sustained espionage: access to the Microsoft 365 accounts and devices of corporate travelers in sectors including government, defense, energy, media, financial services, legal, healthcare, and retail.

Microsoft Threat Intelligence identified notable commonalities in the equipment and management systems across affected networks, suggesting the adversary obtained access to shared services within portions of the captive portal ecosystem rather than breaching venues individually. ReliaQuest, which independently disclosed the activity on July 23, 2026, assessed with low-to-medium confidence that initial access to the captive portal appliances exploited exposed management interfaces (SSH, SNMP, web admin consoles) combined with weak or reused credentials, and documented DNS response forgery on the gateway that acts as the DHCP-assigned resolver for every connected client. Because requests to hard-coded resolvers leave the device as unencrypted traffic the gateway can read and forge, standard protections fail unless strict-mode encrypted DNS (DoH/DoT) or a full-tunnel VPN is enforced.

Once positioned, the actors present victims with three principal redirect outcomes: (1) fake Microsoft 365 authentication pages that harvest credentials; (2) ClickFix-style lures, such as fake browser/OS update screens, a Windows Driver Repair Utility page, and a Google verification failure page, that instruct users to copy and paste attacker-supplied commands into Windows Terminal, PowerShell, or the Run dialog; and (3) since July 16, 2026, redirects into Microsoft's legitimate device-code authentication flow, in which the victim enters an actor-supplied device code on a legitimate Microsoft sign-in page, authenticating an attacker-initiated session and yielding MFA-satisfied OAuth tokens. Some landing pages also direct Android users to download and install a malicious APK. In roughly one-third of observed Windows devices (and some Macs), the attackers additionally attempted Web Proxy Auto-Discovery (WPAD) abuse to route application traffic through an attacker-controlled proxy.

The ClickFix chain delivers two custom malware families. CornFlake is a full-featured Windows RAT written in Go that installs to %APPDATA%\svchost32\svchost32.exe, registers a Windows service named svchost32 displayed as 'Cloud Sync Service' with description 'Synchronizes files with the cloud storage provider', and maintains redundant persistence via service registration, registry Run keys, and scheduled tasks, plus a watchdog routine that continuously restores any removed persistence mechanism. On first execution it operates in dropper mode behind a configurable fake progress window (Windows update, Defender scan, DirectX/vcredist installer, disk optimization, network diagnostics, browser update, or document viewer installer). It provides keylogging, clipboard monitoring with active-window title capture, idle-triggered and on-demand screenshots, WASAPI microphone capture, Media Foundation webcam capture, ChromeKatz-derived browser credential and cookie theft (including Chrome App-Bound Encryption bypass and Firefox NSS/SDR decryption), real-time file exfiltration by category, USB removable-media monitoring, an 18-category security-posture sweep, and a remote shell via cmd.exe or PowerShell. C2 traffic is protected by per-session AES-256-GCM encryption derived from ephemeral P-256 ECDH key exchange with a SHA-256-derived session key over a length-prefixed custom JSON protocol, and a localhost HTTP API (/upload, /reload, /status) lets companion payloads such as ChocoShell reuse the pre-established secure channel. A runtime config file sync.dat supports hot reconfiguration of C2 servers, watched directories, and TLS settings.

ChocoShell is a PowerShell-based information stealer executed entirely in memory with no disk persistence, C2 hardcoded at 213.145.86.112. It beacons over HTTPS to /t/pixel.gif?m=<status> (mimicking a tracking pixel), fetches additional tooling from /cdn/chunks/polyfill-7e2b.min.js (disguised as a JS polyfill), and POSTs exfiltrated data to /t/event as GZip-compressed, Base64-wrapped JSON. It disables AMSI via .NET reflection, evades behavioral detection for PowerShell web request cmdlets, and uses timing-based sandbox/VM detection, exiting silently when a VM is detected. It implements three ordered silent UAC bypass techniques (SilentCleanup windir task hijack, wsreset.exe COM hijack, and sdclt.exe /KickOffElev folder hijack) with fallback to a visible UAC prompt. It steals browser cookies and saved passwords across Chromium-family browsers (Chrome, Edge, Brave, Opera, Opera GX, Vivaldi) including modern ABE decryption via SYSTEM-level DPAPI token impersonation and a Chrome DevTools Protocol path (--remote-debugging-port, Network.getAllCookies) that bypasses ABE entirely, plus Firefox-family (Firefox, Waterfox, LibreWolf, Floorp, Zen) cookies.sqlite copies. It collects Microsoft 365/Entra access, refresh, and WAM tokens from .tbres files in the Token Broker cache, representing a significant enterprise threat as SSO sessions can be replayed without browser cookies, and harvests Wi-Fi credentials via 'netsh wlan show profile key=clear'. A variant targets the WinGet Desired State Configuration host process, suggesting a malicious WinGet DSC configuration vector. Cleanup nulls variables, forces garbage collection, deletes VSS shadow copies via WMI, and removes elevation scripts.

Operators manage the operation through FruitStone, a web-based C2 panel branded as 'CloudSync Console' (footer 'Acuity Systems, Inc. — Cloud Infrastructure Portal v3.2.1'), which is functionally exposed without authentication by default and provides JWT-based operator accounts, a real-time agent dashboard, remote shell, filesystem browser, on-demand collection, live config push, a campaign builder with evasion options, multi-proxy C2 relays with TLS certificate tracking, and beacon profiles supporting sleep intervals and SNI spoofing (e.g., teams.microsoft.com). Microsoft assesses that AI tooling supported a significant portion of the operation, including device code and OAuth code phishing campaigns since February 2026 and AI-assisted development of ChocoShell, whose descriptive developer comments reference Microsoft detection signatures.

Microsoft observed widespread compromise of Wi-Fi networks at hospitality-related organizations across multiple countries, with ReliaQuest reporting targeting across US cities, India, and Saudi Arabia. The operation is distinct from, though TTP-overlapping with, the Forest Blizzard/FrostArmada SOHO-router DNS hijacking disclosed in April 2026; Microsoft attributes CaptiveCrunch to Storm-2945/Midnight Blizzard based on technical overlaps with the Storm-2372 initial-access sub-cluster (device code and OAuth code phishing, Microsoft Graph email exfiltration patterns, social engineering via commercial messaging apps) and consistent Midnight Blizzard victimology.

## MITRE ATT&CK

- T1566.002 Spearphishing Link
- T1078 Valid Accounts
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1543.003 Windows Service
- T1547.001 Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task
- T1548.002 Bypass User Account Control
- T1685 Disable or Modify Tools
- T1497.003 Time Based Checks
- T1070.004 File Deletion
- T1557 Adversary-in-the-Middle
- T1555.003 Credentials from Web Browsers
- T1528 Steal Application Access Token
- T1056.001 Keylogging
- T1113 Screen Capture
- T1123 Audio Capture
- T1573.001 Symmetric Cryptography
- T1071.001 Web Protocols

## Sources

- [CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft](https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/)
- [Russian hackers hijack hotel Wi-Fi networks to spy on travelers, Microsoft says](https://therecord.media/russian-wifi-hackers-hotels)
- [ReliaQuest Threat Spotlight: DNS Poisoning Tactics Expand to Hospitality Wi-Fi](https://reliaquest.com/blog/threat-spotlight-dns-poisoning-tactics-expand-to-hospitality/)
- [Hotel Wi-Fi attacks use custom malware to breach Microsoft 365 accounts](https://www.bleepingcomputer.com/news/security/hotel-wi-fi-attacks-use-custom-malware-to-breach-microsoft-365-accounts/)
- [Hijacked Hotel Wi-Fi pushes fake updates](https://thehackernews.com/2026/08/hijacked-hotel-wi-fi-pushes-fake.html)
- [Russia's SVR borks public Wi-Fis for digital surveillance](https://www.theregister.com/security/2026/08/03/russias-svr-borks-public-wi-fis-for-digital-surveillance/5282399)
- [Russian hackers hijack hotel Wi-Fi to steal Microsoft 365 tokens](https://securityaffairs.com/196441/apt/russian-hackers-hijack-hotel-wi-fi-to-steal-microsoft-365-tokens.html)
- [Malpedia: CornFlake (win.cornflake)](https://malpedia.caad.fkie.fraunhofer.de/details/win.cornflake)
- [Malpedia: ChocoShell (ps1.choco_shell)](https://malpedia.caad.fkie.fraunhofer.de/details/ps1.choco_shell)
- [Storm-2372 conducts device code phishing campaign](https://www.microsoft.com/en-us/security/blog/2025/02/13/storm-2372-conducts-device-code-phishing-campaign/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1853