Microsoft Threat Intelligence has disclosed a sophisticated campaign, dubbed CaptiveCrunch, attributed to the Russian state-sponsored hacking group Storm-2945, an operational sub-cluster of Midnight Blizzard (also known as APT29 or Cozy Bear). Since early May 2026, Storm-2945 has been manipulating Wi-Fi captive portals at hotels, conference centers, and other shared venues globally to redirect travelers to malicious infrastructure, aiming to steal Microsoft 365 tokens and deploy malware.
The attackers achieve this by manipulating DNS and HTTP traffic on compromised networks, directing users through actor-controlled infrastructure. While Microsoft has not named specific providers, the widespread nature of the compromises suggests potential access to shared components within the captive portal ecosystem rather than individual venue breaches. The primary goal of this activity is to gain access to the accounts of corporate travelers.
The campaign involves the deployment of a full-featured Windows remote access trojan (RAT) named CornFlake, written in Go. CornFlake establishes itself as a Windows service named "svchost32" with the display name "Cloud Sync Service" and description "Synchronizes files with the cloud storage provider," mimicking the legitimate svchost.exe process. It employs multiple persistence mechanisms, including Windows service registrations, Registry Run keys, named scheduled tasks, and a continuous watchdog routine to restore any removed persistence.
CornFlake establishes an encrypted command and control (C2) channel using Elliptic Curve Diffie-Hellman (ECDH) P-256 key exchange and a custom JSON protocol. Each C2 session utilizes a unique ephemeral key, making decryption of captured traffic without the session-specific private key impossible. The malware supports dynamic reconfiguration of C2 servers and targeting without redeployment. Its capabilities include keystroke logging, clipboard monitoring, screenshot capture, audio and webcam recording, browser credential theft, file exfiltration, USB device monitoring, detailed system information collection, and remote command execution. It also exposes a local HTTP API, allowing companion malware like ChocoShell to reuse its secure C2 channel.
CornFlake is delivered via "ClickFix"-style landing pages that impersonate legitimate system prompts such as Windows Update screens, Google verification pages, DirectX installers, browser update prompts, and disk optimization utilities. These pages are tailored to appear plausible within the context of the compromised venue. Microsoft also observed indications that Storm-2945 may be targeting Android devices through these same landing pages, providing instructions for APK downloads and installations.
The second tool identified is ChocoShell, a PowerShell infostealer that operates entirely in memory. ChocoShell's primary objective is credential theft, specifically collecting Microsoft 365 and Azure Active Directory (AD) access tokens, refresh tokens, and Web Account Manager (WAM) tokens from .tbres files in the Token Broker cache. The collection of these tokens poses a significant threat to enterprise environments, as it allows threat actors to replay single sign-on (SSO) sessions without needing browser cookies.
ChocoShell also harvests Wi-Fi credentials using `netsh wlan show profile with key=clear`, implements three silent User Account Control (UAC) bypass techniques with ordered fallback, disables Windows Defender signature updates, and uses the Chrome DevTools Protocol to extract browser cookies. This latter technique bypasses Chrome's App-Bound Encryption.
Since July 16, some CaptiveCrunch landing pages have incorporated device code phishing. Guests are redirected into Microsoft's legitimate device code authentication flow, where the attacker initiates an authentication request and presents the user with a code to enter on Microsoft's real sign-in page. When the user enters the code, they inadvertently authenticate the attacker's session, which then benefits from any multi-factor authentication (MFA) the user just completed. Microsoft recommends blocking the device code flow through Conditional Access policies where it is not explicitly required.
Researchers also detailed FruitStone, the web-based C2 panel utilized by Storm-2945 operators to manage the CaptiveCrunch campaign. This panel provides a centralized interface for controlling CornFlake implants, deploying payloads, and collecting stolen data.
