# CaptiveCrunch Campaign — Storm-2945 Delivers ChocoShell/CornFlake Malware via Compromised Hotel Captive Portal Wi-Fi

> Microsoft Threat Intelligence disclosed the CaptiveCrunch campaign (July 31, 2026), attributed to Storm-2945, a sub-cluster of the Russia-linked Midnight Blizzard (APT29/SVR). The campaign compromises captive-portal Wi-Fi infrastructure at hotels and conference centers worldwide, using DNS/HTTP poisoning to deliver two custom malware families — ChocoShell (PowerShell infostealer) and CornFlake (Go RAT) — alongside abuse of Microsoft Entra ID device code authentication for persistent M365 token theft targeting corporate travelers.

- **Published:** 2026-08-04T00:00:00Z
- **Last reviewed:** 2026-10-10T18:19:11.972Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1857
- **ID:** TL-2026-1857
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Storm-2945 (Russia)
- **Detections:** 9 · **IOCs:** 34 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Storm-2945, first observed conducting AI-augmented device code and OAuth phishing operations in February 2026, escalated to widespread traffic manipulation via compromised hospitality captive portal networks beginning in early May 2026. The actor compromises Wi-Fi gateway appliances — likely via exposed management interfaces (SSH, SNMP, web admin) with weak or reused credentials — and uses control over DNS resolution to forge responses, redirecting all guest traffic through actor-controlled infrastructure. Unlike APT28's FrostArmada campaign, which used keyword-based selective DNS filtering, CaptiveCrunch redirects all DNS requests indiscriminately. In roughly one-third of observed cases, the actor also abuses Web Proxy Auto-Discovery (WPAD) to push a malicious PAC file that proxies application traffic through attacker infrastructure, a technique not previously documented in FrostArmada-linked campaigns.

Upon connection to the compromised network, victims are redirected to doppelganger domains impersonating Microsoft online services (m365-owa.com, owa-ms365.com, ms365-live.com, ms365-device.com). These landing pages serve one of several payload delivery mechanisms: (1) ClickFix-style prompts instructing users to open a terminal and run an attacker-supplied command that downloads and executes signed binaries; (2) fake browser or OS update pages delivering CornFlake via a multi-stage dropper chain; or (3) since July 16, 2026, Microsoft Entra ID device code authentication pages that trick victims into entering attacker-generated device codes into legitimate Microsoft sign-in pages, authorizing the attacker's OAuth session and yielding MFA-satisfied tokens without requiring password interception.

CornFlake (compiled Go RAT, SHA256: 918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593, first observed July 3, 2026) masquerades as a benign Windows service named 'svchost32' with display name 'Cloud Sync Service' and description 'Synchronizes files with the cloud storage provider,' installed at %APPDATA%\svchost32\svchost32.exe with config in sync.dat. It uses ECDH P-256 ephemeral key exchange with SHA-256 derived session keys over TLS-wrapped TCP (magic bytes 0xAB hello / 0xAC ack), with per-session AES-256-GCM encryption and 18-41 second randomized heartbeat intervals (opcode 0xE7). CornFlake registers layered persistence: Windows service, Registry Run keys, scheduled tasks, and a watchdog routine that recreates any deleted persistence artifacts. During installation it displays a configurable fake progress window (winupdate, defender, directx, vcredist, sysopt, netfix, browser, pdfview). Capabilities include keylogging via Raw Input API, clipboard monitoring with SHA-256 dedup and active window title capture, screenshot capture, WASAPI microphone recording, Media Foundation webcam capture (JPEG), a ChromeKatz-derived credential theft module for Chromium (ABE bypass) and Firefox (NSS/SDR), file exfiltration (1000 files/500 MB per cycle categorized by extension), USB removable media monitoring, security posture sweep across 18 categories, and remote shell for arbitrary cmd.exe or PowerShell (-NoP) execution. It exposes a localhost HTTP API (/upload, /reload, /status).

ChocoShell (PowerShell infostealer, SHA256: be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c, first observed July 10, 2026) runs entirely in memory with no long-term persistence. Its C2 infrastructure centers on 213.145.86.112 with three URL paths: beacon via /t/pixel.gif?m=<status> (mimicking tracking pixels), tooling fetch from /cdn/chunks/polyfill-7e2b.min.js (mimicking JavaScript polyfill libraries), and exfiltration via POST to /t/event (JSON-structured, GZip-compressed, Base64-encoded over HTTPS). Defense evasion includes AMSI disablement via .NET reflection and timing-based VM/sandbox detection with silent exit. Privilege escalation uses three ordered UAC bypass techniques with fallback — SilentCleanup task hijack (%windir% env var), wsreset.exe COM hijack, and sdclt.exe folder hijack (/KickOffElev) — plus SYSTEM token impersonation from winlogon.exe, wininit.exe, or services.exe. Chrome App-Bound Encryption is bypassed via two parallel methods: SYSTEM DPAPI impersonation (accessing Chrome's two-layer DPAPI-protected encryption keys from SYSTEM context via the CNG 'Google Chromekey1' key), and Chrome DevTools Protocol abuse (launching Chrome with --remote-debugging-port and calling Network.getAllCookies via WebSocket to extract plaintext session data). ChocoShell targets browser master keys, cookies, and saved passwords from Chromium and Firefox families; Microsoft 365 and Azure AD access tokens, refresh tokens, and Web Account Manager (WAM) tokens from .tbres files in the Token Broker cache; and cleartext Wi-Fi profiles via netsh wlan show profile key=clear. Cleanup includes variable nulling, forced garbage collection, WMI-based VSS shadow copy deletion, and UAC bypass registry key removal. A variant targets the WinGet DSC host process (ConfigurationRemotingServer). Extensive code comments suggest AI-assisted generation.

The FruitStone C2 panel (branded as 'CloudSync Console,' footer 'Acuity Systems, Inc. — Cloud Infrastructure Portal v3.2.1') is a web-based single-page application with JWT authentication, multi-operator support, SSE real-time agent updates, and a campaign builder wizard covering identity, capabilities, file paths, and evasion settings (garble symbol randomization, XOR string encoding, GZip compression). Infrastructure management includes proxy relays with TLS cert tracking, beacon profiles with SNI spoofing (e.g., teams.microsoft.com), and staging servers with push-to-deploy.

Microsoft assesses the actor leveraged AI tools to support a significant portion of these operations, including malware code generation with consistent coding standards and descriptive commentary, device code and OAuth code phishing campaign automation, and AI-driven infrastructure management. Storm-2945's device code phishing operations date back to at least August 2024, with a documented evolution from Microsoft Teams-themed device code phishing (Storm-2372, February 2025) to the current AI-augmented multi-vector CaptiveCrunch campaign. The campaign targets corporate travelers across financial services, professional services, legal, healthcare, energy, and retail sectors, across multiple countries including the United States, India, and Saudi Arabia. ClickFix landing pages also include Android APK delivery instructions, indicating mobile platform targeting.

## MITRE ATT&CK

- T1583.001 Domains
- T1584.002 DNS Server
- T1557 Adversary-in-the-Middle
- T1566.003 Spearphishing via Service
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1543.003 Windows Service
- T1547.001 Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task
- T1548.002 Bypass User Account Control
- T1134.001 Token Impersonation/Theft
- T1685 Disable or Modify Tools
- T1036.005 Match Legitimate Resource Name or Location
- T1070.006 Timestomp
- T1497 Virtualization/Sandbox Evasion
- T1555.003 Credentials from Web Browsers
- T1528 Steal Application Access Token
- T1539 Steal Web Session Cookie
- T1555.004 Windows Credential Manager
- T1056.001 Keylogging
- T1113 Screen Capture
- T1123 Audio Capture
- T1125 Video Capture
- T1005 Data from Local System
- T1566.002 Phishing
- T1189 Drive-by Compromise
- T1204.004 User Execution
- T1071.001 Application Layer Protocol
- T1041 Exfiltration Over C2 Channel

## Sources

- [CaptiveCrunch: Midnight Blizzard targets travelers worldwide — Microsoft Security Blog](https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/)
- [Threat Spotlight: DNS Poisoning Tactics Expand to Hospitality Wi-Fi — ReliaQuest](https://reliaquest.com/blog/threat-spotlight-dns-poisoning-tactics-expand-to-hospitality/)
- [Hotel Wi-Fi Attacks Use Custom Malware to Breach Microsoft 365 Accounts — BleepingComputer](https://www.bleepingcomputer.com/news/security/hotel-wi-fi-attacks-use-custom-malware-to-breach-microsoft-365-accounts/)
- [Hijacked Hotel Wi-Fi Pushes Fake Browser Updates to Install Malware — The Hacker News](https://thehackernews.com/2026/08/hijacked-hotel-wi-fi-pushes-fake.html)
- [Russia's SVR borks public Wi-Fis for digital surveillance — The Register](https://www.theregister.com/security/2026/08/03/russias-svr-borks-public-wi-fis-for-digital-surveillance/5282399)
- [ChocoShell Steals Microsoft 365 Accounts via Hotel Wi-Fi Networks — GBHackers](https://gbhackers.com/chocoshell-steals-microsoft-365/)
- [ChocoShell — Malpedia Entry](https://malpedia.caad.fkie.fraunhofer.de/details/ps1.choco_shell)
- [CornFlake — Malpedia Entry](https://malpedia.caad.fkie.fraunhofer.de/details/win.cornflake)
- [Multiple Russian Threat Actors Targeting Microsoft Device Code Authentication — Volexity](https://www.volexity.com/blog/2025/02/13/multiple-russian-threat-actors-targeting-microsoft-device-code-authentication/)
- [Offensive DPAPI with Nemesis — SpecterOps](https://specterops.io/blog/2026/03/04/offensive-dpapi-with-nemesis/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1857