Microsoft named the campaign CaptiveCrunch and says it has been active since at least early May, a targeted operation that manipulates hotel and conference Wi‑Fi to steal Microsoft 365 accounts and install persistent malware.
Attribution: Midnight Blizzard (APT29) and the Storm‑2945 sub‑cluster
Microsoft linked the global campaign to the Russian threat actor Midnight Blizzard, also known as APT29, and specifically to a sub‑cluster tracked as Storm‑2945. The activity had been previously disclosed by cybersecurity company ReliaQuest, which described DNS changes on captive‑portal devices used to harvest Microsoft 365 credentials. Microsoft added technical detail and two new malware family names — CornFlake and ChocoShell — and said the threat actor has been running device and OAuth code phishing operations since February.
How CaptiveCrunch manipulates captive‑portal Wi‑Fi and authentication flows
According to Microsoft, attackers modify DNS and HTTP traffic on networks served by captive portal equipment for hotels and conference centers. Once DNS settings are changed, victims can be redirected to phishing pages that impersonate Microsoft 365 login portals or to device‑code phishing pages that abuse Microsoft Entra ID authentication flows. Microsoft observed this redirection activity beginning in July.
Microsoft was unable to determine the precise initial compromise vector, but noted signs of breaches in shared infrastructure rather than isolated devices. A previously unreported technique observed by Microsoft uses fake browser and operating‑system update pages delivering malware to Windows via ClickFix prompts that ask users to verify an action. Some ClickFix landings also contained evidence the operator attempted to deliver an Android APK.
Built by Nubivance.
OSINTSights' secure edge-first architecture, AI content pipeline, and serverless ops are designed by Nubivance. We do this for clients too.
Talk to us →CornFlake: a Go‑based RAT built for persistence and surveillance
Microsoft analyzed CornFlake as a Go‑based remote access trojan (RAT) with an extensive set of features for long‑term access and surveillance. Capabilities Microsoft reported include:
- remote shell access;
- keylogging and clipboard monitoring;
- screenshot capture, microphone and webcam surveillance;
- browser credential and cookie theft and Microsoft 365 session token theft;
- file exfiltration, USB monitoring, and system reconnaissance.
When executed, CornFlake displays a fake progress window to distract the user while the binary copies into %AppData% for persistence. The bogus window can be configured to mimic various legitimate prompts — a Windows update, a Defender scan, disk optimization, network diagnostics, a browser update, or a document viewer installer. CornFlake disguises itself as “Cloud Sync Service” and employs multiple persistence mechanisms, including Windows service registrations, registry run keys, scheduled tasks, and a watchdog routine designed to restore any lost persistence.
ChocoShell, FruitStone, and signs of AI‑assisted development
Microsoft described ChocoShell as an in‑memory PowerShell credential stealer that targets browser cookies, saved passwords, Microsoft 365 and Azure AD tokens, and Wi‑Fi credentials. Researchers also found an unprotected web‑based management panel called FruitStone that the operator used to manage infected systems: browsing victim files, executing PowerShell commands, and capturing screenshots and keystrokes.
Noting extensive comments in the malware code, Microsoft assessed that AI tools were likely used in development of CornFlake and ChocoShell. The combination of credential theft, token harvesting and remote access tooling explains how the operator can convert network interception into persistent access to Microsoft 365 accounts and host systems.
Recommendations for travelers, defenders, and enterprises
Microsoft’s guidance on this campaign is explicit and targeted to the tools and techniques observed:
- Treat hotel and conference Wi‑Fi as untrusted; prefer private cellular or managed connections when possible.
- Avoid software updates or tools offered through captive portals and do not accept unsolicited ClickFix prompts.
- Adopt phishing‑resistant authentication such as MFA and passkeys, and disable Microsoft Entra device code authentication if it is not needed.
- Avoid using corporate credentials to register for guest Wi‑Fi networks.
The published briefing also cited a Picus whitepaper finding that security teams log 54% of successful attacks but alert on only 14%, a gap that underscores how campaigns that modify shared network infrastructure can move through environments unseen.
CaptiveCrunch illustrates an operational pattern: intercept at the network edge, harvest credentials or tokens via phishing and device‑code flows, then drop implants that prioritize persistence and data capture. Microsoft’s technical findings — from DNS tampering to ClickFix installers, CornFlake persistence, ChocoShell token theft and an exposed FruitStone panel — map a full kill chain from interception to long‑term compromise. For defenders and travelers alike, the immediate choices are concrete: treat captive portals as hostile, reduce reliance on device‑code authentication, and harden token‑based sessions with phishing‑resistant controls.
