Loading story…
Microsoft Threat Intelligence and Zscaler reported that Storm-2945, a sub-cluster of Midnight Blizzard / APT29 linked to Russia, has been compromising shared captive-portal infrastructure at hotels, conference centers, and similar venues to intercept traveler traffic and steal Microsoft 365 credentials. The operation, dubbed CaptiveCrunch, manipulates DNS and HTTP flows to redirect victims from legitimate Wi-Fi login pages to attacker-controlled phishing and malware-delivery sites, including lures for Microsoft Entra ID device code phishing and ClickFix-style fake updates. Activity has been observed in multiple U.S. cities as well as India and Saudi Arabia, indicating a broad campaign aimed at travelers across sectors.
Researchers said the campaign deploys multiple payloads after credential theft, including CornFlake, a Go-based Windows RAT used for persistence and surveillance, and ChocoShell, an in-memory PowerShell stealer designed to collect browser secrets, Microsoft 365 and Azure AD/WAM tokens, and Wi-Fi credentials. The operation has also expanded to Android through malicious APKs, and Microsoft assessed that AI-assisted tooling supported parts of the intrusion set, including development of CornFlake and ChocoShell. The reporting indicates the attackers are using trusted hospitality network infrastructure as an initial access vector to harvest identities and extend compromise onto victim devices.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Microsoft Threat Intelligence reported the ongoing CaptiveCrunch campaign, which steals credentials by abusing captive portal infrastructure at hotels, conference centers, and similar venues. The campaign was attributed to Storm-2945, a sub-cluster of Midnight Blizzard/APT29.
Subsequent reporting described how Storm-2945 redirected victims on compromised captive portal networks to Microsoft 365 phishing, Entra ID device code phishing, ClickFix-style fake update pages, and Android APK delivery. The reporting also identified the CornFlake Windows RAT and ChocoShell PowerShell stealer as malware used in the campaign.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
schneier.com
Open sourcecommunity.gurucul.com
Open sourcemalware.news
Open sourcezscaler.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft linked the **CaptiveCrunch** campaign to **Storm-2945**, a subgroup of the Russian state-backed **Midnight Blizzard** actor, after attackers compromised captive portal ecosystems used by hospitality organizations and other shared public venues. By manipulating **DNS** and **HTTP** traffic on public Wi-Fi gateway infrastructure, the group conducted **adversary-in-the-middle (AiTM)** attacks that intercepted login flows and stole **Microsoft 365** credentials from traveling employees across multiple sectors. The operation also pushed follow-on malware and phishing lures through the hijacked portals. Victims were shown fake browser update prompts delivering malware including **CornFlake** and **ChocoShell**, alongside **ClickFix**-style social engineering and malicious Android **APK** prompts; some recent landing pages also added **device code phishing**, a technique Microsoft said Midnight Blizzard has used since 2024. The campaign has reportedly been active since May and focused on hospitality-linked networks and other public access environments where users expect captive portal authentication.
Aug 6, 2026
Microsoft reported that social-engineering lures are increasingly being used to trick users into launching malware themselves, with the **ClickFix** technique emerging as a major delivery method across phishing, malvertising, and compromised websites. In ClickFix attacks, victims are shown fake CAPTCHA, verification, or repair prompts that copy malicious commands to the clipboard and persuade them to run them, often leading to fileless execution through LOLBins, obfuscated PowerShell, and follow-on payloads such as **Lumma Stealer**, **DarkGate**, **Latrodectus**, **ScreenConnect**, and **AMOS**. Microsoft said the technique has hit thousands of enterprise and consumer devices daily and is now supported by a growing underground market of ClickFix builder kits sold on criminal forums. Fresh activity shows the tactic continuing to evolve. A **SmartApeSG** campaign observed on compromised web traffic redirected victims to a fake human-verification flow that fetched an HTA downloader from `deltaode[.]com`, retrieved a ZIP archive, and abused DLL side-loading to launch an unidentified RAT that later communicated with `89.124.79[.]98` over TCP 443. Separately, Microsoft linked the **CaptiveCrunch** campaign to **Storm-2945**, a sub-cluster of Russia-linked **Midnight Blizzard**, which has manipulated DNS and HTTP traffic on hospitality and other captive-portal networks to redirect travelers to phishing pages and fake browser or OS updates delivering **CornFlake** and **ChocoShell** for credential theft and espionage, including theft of browser credentials, Microsoft 365 tokens, and Wi-Fi credentials.
Aug 1, 2026
Attackers have been compromising captive portal and hotel Wi-Fi gateway appliances, then changing DNS settings to redirect connected guests to attacker-controlled infrastructure that impersonates Microsoft 365 sign-in pages. ReliaQuest said the activity has hit hotels, conference centers, and similar shared venues in multiple U.S. cities as well as India and Saudi Arabia, affecting travelers from sectors including finance, legal, healthcare, energy, and retail. The campaign uses lookalike domains such as `m365-owa.com`, `owa-ms365.com`, `ms365-device.com`, and `ms365-live.com` to harvest credentials or lure users into Microsoft device code authentication flows.
Aug 14, 2026