Threat reportMalwareTL-2026-1857

CaptiveCrunch Campaign — Storm-2945 Delivers ChocoShell/CornFlake Malware via Compromised Hotel Captive Portal Wi-Fi

highACTIVE

CaptiveCrunch Campaign (TL-2026-1857), also tracked as CaptiveCrunch, is a high-severity malware campaign, first published 2026-08-04 and last reviewed 2026-10-10. It is attributed to Storm-2945 (Russia) with high confidence, affects Microsoft Microsoft 365 / Entra ID, maps to 30 MITRE ATT&CK techniques (T1005, T1036.005, T1041), and is covered by 9 detection rules and 34 indicators of compromise.

Severity
HIGHAssessed severity
CVEs
0None referenced
Techniques
30MITRE ATT&CK
Actors
1Storm-2945
Detection rules
9SPL · KQL · Sigma
IOCs
34Indicators of compromise

Key facts for TL-2026-1857

Threat ID
TL-2026-1857
Also known as
CaptiveCrunch
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
Last reviewed
Attribution
Storm-2945
Attribution confidence
HIGH
Nation-state nexus
Russia
Motivation
ESPIONAGE
Target sectors
financial-services, professional-services, legal, health, energy, retail
Target regions
united states of america, india, saudi arabia, Europe
Detection rules
9
Indicators of compromise
34
Updates
2026-10-10 · revalidated 1× · latest source

Malware and tooling in CaptiveCrunch Campaign

Malware and tooling: ChocoShell, CornFlake, Storm, ChromeKatz, FruitStone

How CaptiveCrunch Campaign works

Microsoft Threat Intelligence disclosed the CaptiveCrunch campaign (July 31, 2026), attributed to Storm-2945, a sub-cluster of the Russia-linked Midnight Blizzard (APT29/SVR). The campaign compromises captive-portal Wi-Fi infrastructure at hotels and conference centers worldwide, using DNS/HTTP poisoning to deliver two custom malware families — ChocoShell (PowerShell infostealer) and CornFlake (Go RAT) — alongside abuse of Microsoft Entra ID device code authentication for persistent M365 token theft targeting corporate travelers.

Storm-2945, first observed conducting AI-augmented device code and OAuth phishing operations in February 2026, escalated to widespread traffic manipulation via compromised hospitality captive portal networks beginning in early May 2026. The actor compromises Wi-Fi gateway appliances — likely via exposed management interfaces (SSH, SNMP, web admin) with weak or reused credentials — and uses control over DNS resolution to forge responses, redirecting all guest traffic through actor-controlled infrastructure. Unlike APT28's FrostArmada campaign, which used keyword-based selective DNS filtering, CaptiveCrunch redirects all DNS requests indiscriminately. In roughly one-third of observed cases, the actor also abuses Web Proxy Auto-Discovery (WPAD) to push a malicious PAC file that proxies application traffic through attacker infrastructure, a technique not previously documented in FrostArmada-linked campaigns.

Upon connection to the compromised network, victims are redirected to doppelganger domains impersonating Microsoft online services (m365-owa.com, owa-ms365.com, ms365-live.com, ms365-device.com). These landing pages serve one of several payload delivery mechanisms: (1) ClickFix-style prompts instructing users to open a terminal and run an attacker-supplied command that downloads and executes signed binaries; (2) fake browser or OS update pages delivering CornFlake via a multi-stage dropper chain; or (3) since July 16, 2026, Microsoft Entra ID device code authentication pages that trick victims into entering attacker-generated device codes into legitimate Microsoft sign-in pages, authorizing the attacker's OAuth session and yielding MFA-satisfied tokens without requiring password interception.

CornFlake (compiled Go RAT, SHA256: 918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593, first observed July 3, 2026) masquerades as a benign Windows service named 'svchost32' with display name 'Cloud Sync Service' and description 'Synchronizes files with the cloud storage provider,' installed at %APPDATA%\svchost32\svchost32.exe with config in sync.dat. It uses ECDH P-256 ephemeral key exchange with SHA-256 derived session keys over TLS-wrapped TCP (magic bytes 0xAB hello / 0xAC ack), with per-session AES-256-GCM encryption and 18-41 second randomized heartbeat intervals (opcode 0xE7). CornFlake registers layered persistence: Windows service, Registry Run keys, scheduled tasks, and a watchdog routine that recreates any deleted persistence artifacts. During installation it displays a configurable fake progress window (winupdate, defender, directx, vcredist, sysopt, netfix, browser, pdfview). Capabilities include keylogging via Raw Input API, clipboard monitoring with SHA-256 dedup and active window title capture, screenshot capture, WASAPI microphone recording, Media Foundation webcam capture (JPEG), a ChromeKatz-derived credential theft module for Chromium (ABE bypass) and Firefox (NSS/SDR), file exfiltration (1000 files/500 MB per cycle categorized by extension), USB removable media monitoring, security posture sweep across 18 categories, and remote shell for arbitrary cmd.exe or PowerShell (-NoP) execution. It exposes a localhost HTTP API (/upload, /reload, /status).

ChocoShell (PowerShell infostealer, SHA256: be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c, first observed July 10, 2026) runs entirely in memory with no long-term persistence. Its C2 infrastructure centers on 213.145.86.112 with three URL paths: beacon via /t/pixel.gif?m=<status> (mimicking tracking pixels), tooling fetch from /cdn/chunks/polyfill-7e2b.min.js (mimicking JavaScript polyfill libraries), and exfiltration via POST to /t/event (JSON-structured, GZip-compressed, Base64-encoded over HTTPS). Defense evasion includes AMSI disablement via .NET reflection and timing-based VM/sandbox detection with silent exit. Privilege escalation uses three ordered UAC bypass techniques with fallback — SilentCleanup task hijack (%windir% env var), wsreset.exe COM hijack, and sdclt.exe folder hijack (/KickOffElev) — plus SYSTEM token impersonation from winlogon.exe, wininit.exe, or services.exe. Chrome App-Bound Encryption is bypassed via two parallel methods: SYSTEM DPAPI impersonation (accessing Chrome's two-layer DPAPI-protected encryption keys from SYSTEM context via the CNG 'Google Chromekey1' key), and Chrome DevTools Protocol abuse (launching Chrome with --remote-debugging-port and calling Network.getAllCookies via WebSocket to extract plaintext session data). ChocoShell targets browser master keys, cookies, and saved passwords from Chromium and Firefox families; Microsoft 365 and Azure AD access tokens, refresh tokens, and Web Account Manager (WAM) tokens from .tbres files in the Token Broker cache; and cleartext Wi-Fi profiles via netsh wlan show profile key=clear. Cleanup includes variable nulling, forced garbage collection, WMI-based VSS shadow copy deletion, and UAC bypass registry key removal. A variant targets the WinGet DSC host process (ConfigurationRemotingServer). Extensive code comments suggest AI-assisted generation.

The FruitStone C2 panel (branded as 'CloudSync Console,' footer 'Acuity Systems, Inc. — Cloud Infrastructure Portal v3.2.1') is a web-based single-page application with JWT authentication, multi-operator support, SSE real-time agent updates, and a campaign builder wizard covering identity, capabilities, file paths, and evasion settings (garble symbol randomization, XOR string encoding, GZip compression). Infrastructure management includes proxy relays with TLS cert tracking, beacon profiles with SNI spoofing (e.g., teams.microsoft.com), and staging servers with push-to-deploy.

Microsoft assesses the actor leveraged AI tools to support a significant portion of these operations, including malware code generation with consistent coding standards and descriptive commentary, device code and OAuth code phishing campaign automation, and AI-driven infrastructure management. Storm-2945's device code phishing operations date back to at least August 2024, with a documented evolution from Microsoft Teams-themed device code phishing (Storm-2372, February 2025) to the current AI-augmented multi-vector CaptiveCrunch campaign. The campaign targets corporate travelers across financial services, professional services, legal, healthcare, energy, and retail sectors, across multiple countries including the United States, India, and Saudi Arabia. ClickFix landing pages also include Android APK delivery instructions, indicating mobile platform targeting.

MITRE ATT&CK techniques used in TL-2026-1857

Collection

T1005 Data from Local System; T1113 Screen Capture; T1123 Audio Capture; T1125 Video Capture

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location; T1070.006 Timestomp; T1497 Virtualization/Sandbox Evasion

Exfiltration

T1041 Exfiltration Over C2 Channel

Persistence

T1053.005 Scheduled Task; T1543.003 Windows Service; T1547.001 Registry Run Keys / Startup Folder

Credential Access

T1056.001 Keylogging; T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers; T1555.004 Windows Credential Manager

Execution

T1059.001 PowerShell; T1059.003 Windows Command Shell; T1204.002 Malicious File; T1204.004 User Execution

Command and Control

T1071.001 Application Layer Protocol

Privilege Escalation

T1134.001 Token Impersonation/Theft; T1548.002 Bypass User Account Control

Initial Access

T1189 Drive-by Compromise; T1566.002 Phishing; T1566.003 Spearphishing via Service

credential-access

T1557 Adversary-in-the-Middle

Resource Development

T1583.001 Domains; T1584.002 DNS Server

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in CaptiveCrunch Campaign

  • Microsoft — Microsoft 365 / Entra ID
    Vulnerable versions: All versions using device code authentication flow
  • Google — Chrome Browser
    Vulnerable versions: Versions prior to v127
    Fixed in: v127+ with App-Bound Encryption (bypassable via CDP and SYSTEM DPAPI impersonation)
  • Mozilla — Firefox
    Vulnerable versions: All versions
  • Multiple — Hotel Captive Portal Appliances
    Vulnerable versions: Various vendors

Remediation for CaptiveCrunch Campaign

Immediate actions

  • Disable Microsoft Entra ID device code authentication flow via Conditional Access if not required for operational needs
  • Block the four known doppelganger domains (ms365-device.com, ms365-live.com, m365-owa.com, owa-ms365.com) and six known C2 IPs at perimeter firewalls and proxy servers
  • Deploy detection rules for svchost32.exe running from %APPDATA% and PowerShell in-memory execution (script block logging)
  • Enable Chrome App-Bound Encryption enforcement and monitor for --remote-debugging-port command-line flags in non-interactive browser launches
  • Block WPAD DHCP option 252 and DNS-based WPAD lookups at the network gateway

Workarounds

  • Enable ApplicationBoundEncryptionEnabled policy in Chrome/Edge to enforce App-Bound Encryption (note: can be disabled with admin privileges)
  • Disable WPAD in Windows via Group Policy or registry in enterprise environments

Longer-term hardening

  • Treat all hospitality and public guest networks as inherently untrusted; enforce always-on full-tunnel VPN for enterprise devices
  • Favor managed mobile hotspots, travel routers, or eSIM-based connectivity for sensitive resource access while traveling
  • Deploy phishing-resistant MFA (passkeys/FIDO2) across all enterprise Microsoft 365 and Azure AD environments
  • Implement device enrollment restrictions limiting which devices can be registered in Entra ID
  • Establish continuous monitoring for anomalous device code authorizations, unusual Token Broker cache access, and WAM artifact theft indicators
  • Deploy EDR with behavioral detection for credential access patterns (DPAPI abuse, Chrome DevTools Protocol)

Timeline of CaptiveCrunch Campaign

Showing the 20 most recent tracked events.

  • Midnight Blizzard begins device code phishing operations targeting Microsoft 365 accounts, establishing the TTP foundation later used in CaptiveCrunch
  • Volexity publishes report on multiple Russian threat actors (including Midnight Blizzard sub-cluster CozyLarch) conducting device code authentication phishing campaigns impersonating U.S. Department of State
  • Storm-2945 begins AI-augmented device code and OAuth code phishing campaigns; ChocoShell C2 IP 107.189.26.194 first observed in infrastructure
  • Earliest AitM infrastructure IP 104.194.159.150 first observed as part of CaptiveCrunch infrastructure buildout
  • CaptiveCrunch traffic manipulation via compromised hotel and conference center captive portal networks begins; DNS/HTTP poisoning first observed by Microsoft Threat Intelligence
  • Doppelganger domain ms365-live.com registered and first observed used for device code flow redirects
  • AitM infrastructure IP 38.146.28.75 and ChocoShell primary C2 IP 213.145.86.112 first observed
  • First CornFlake RAT binary (SHA256: 918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593) observed in the wild
  • First ChocoShell PowerShell infostealer binary (SHA256: be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c) observed in the wild
  • DNS resolver IP 38.146.28.132 first observed as part of CaptiveCrunch attack infrastructure
  • Device code phishing integrated into CaptiveCrunch landing pages; doppelganger domain owa-ms365.com and IP 31.57.243.154 first observed
  • Doppelganger domain m365-owa.com first observed as part of CaptiveCrunch AitM infrastructure
  • Doppelganger domain ms365-device.com first observed with active operator panel (page rotation, IP allowlisting, telemetry); ReliaQuest independently publishes DNS Poisoning Tactics Threat Spotlight reporting on the same domains and infrastructure
  • Microsoft Threat Intelligence publishes comprehensive CaptiveCrunch disclosure attributing the campaign to Storm-2945 (Midnight Blizzard sub-cluster) detailing ChocoShell, CornFlake, FruitStone C2, and device code phishing integration
  • GBHackers publishes detailed threat analysis of ChocoShell and the CaptiveCrunch campaign
  • Zscaler ThreatLabz publishes technical analysis of CornFlake, ChocoShell and the FruitStone C2 panel.
  • SOC Prime publishes detection content for CaptiveCrunch.
  • Storm-2945 resumes CaptiveCrunch operations with new infrastructure; Black Lotus Labs reporting implicates multiple hospitality managed service providers.
  • Microsoft updates its report detailing a Rust variant of CornFlake and AI-enabled development characteristics.
  • Cyber Security News reports on the renewed campaign, listing domains, IPs and SHA-256 hashes.

Update history for TL-2026-1857

Sources cited for CaptiveCrunch Campaign

Detection coverage for TL-2026-1857

As of 2026-10-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1857 across Splunk SPL, Microsoft KQL and Sigma, covering 34 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

9 detection rules (Splunk SPL, Microsoft KQL, Sigma) · Blue and above. Compare plans
34 indicators of compromise · Red and above. Compare plans

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level
Fig. 01 · Threat weatherIndexing the archive…
1 square = 1 threat · click to open

Latest Threats