Summary
- Microsoft has named Storm-2945, a subdivision of SVR’s Midnight Blizzard, as responsible for a campaign it calls CaptiveCrunch, active since at least February 2026 with traffic manipulation observed from early May.
- Attackers gain adversary-in-the-middle position by manipulating DNS and HTTP traffic on captive portal networks, then use ClickFix-style prompts disguised as OS updates or driver repairs to deliver malware.
- The primary implant, CornFlake, is a full-featured Windows RAT capable of keylogging, screen and audio capture, browser credential theft, and remote shell access; it also delivers a secondary in-memory infostealer called ChocoShell.
- A separate strand of the campaign uses device code phishing via attacker-controlled landing pages to harvest valid OAuth tokens for Microsoft 365 accounts, potentially bypassing MFA.
- Microsoft’s primary technical recommendation is to disable the device code authentication flow where possible and favour personal hotspots over public networks for staff travelling to hospitality venues.
Attribution and Scope
Microsoft has attributed the CaptiveCrunch campaign to Storm-2945, identified as a subdivision of Midnight Blizzard — the SVR-linked group also known as Nobelium. The operation is described as AI-assisted and dates to February 2026, with observable traffic manipulation beginning in early May. ReliaQuest’s earlier research contributed to the attribution. The campaign targets users of public Wi-Fi at hotels, conference centres, and other hospitality venues, though Microsoft has not publicly named specific locations or disclosed how many organisations or individuals have been affected.
How the Attack Works
The initial compromise vector for the captive portal networks themselves remains under investigation; Microsoft has stated it is still working to determine how Storm-2945 gains that first foothold. Once in control of the network layer, the group manipulates DNS and HTTP traffic to route users through attacker-controlled infrastructure, establishing an adversary-in-the-middle position. The attackers also abuse operating systems’ built-in connectivity checks — the routine pings devices make to confirm internet access — to trigger malicious prompts and redirects before a user has knowingly interacted with anything.
ClickFix Delivery and the CornFlake Implant
Fake prompts presented to users mimic familiar Windows notifications: update progress windows, driver repair requests, and web verification failures. Users who follow the instructions may install CornFlake, described by Microsoft as a full-featured Windows RAT written in Go. Once resident on a device, CornFlake provides attackers with keylogging, clipboard monitoring, screenshot and audio capture, video surveillance, browser credential theft, file exfiltration, USB drive monitoring, a security posture sweep, and remote shell access. It also exposes a localhost HTTP API that makes it a modular platform for additional payloads. Microsoft has also observed ClickFix prompts tailored to Android devices, prompting users to install an APK file, though Windows remains the primary target.
ChocoShell: In-Memory Credential Extraction
CornFlake’s most notable secondary payload is ChocoShell, a PowerShell-based infostealer delivered and executed entirely in memory. Its focus is narrow but high-value: browser session cookies, saved passwords, single sign-on tokens, and Wi-Fi credentials. Microsoft’s own framing neatly separates the two tools — CornFlake provides persistence and long-running operator access, while ChocoShell extracts the credentials most useful for moving into cloud environments.
Device Code Phishing via the Captive Portal
A portion of the CaptiveCrunch activity does not involve malware at all. Instead, users directed through attacker-controlled landing pages are instructed to enter a device code on a legitimate Microsoft authentication page. The device code was originally issued to the attacker. Completing the flow hands the attacker a valid OAuth token for the victim’s Microsoft 365 account. Microsoft notes this technique is consistent with Midnight Blizzard device code phishing operations observed since August 2024 and is not fundamentally novel on its own. What changes here is context: integrating the technique into a captive portal compromise, where users already expect to authenticate, makes the request appear more plausible. The OAuth token grants access to cloud data within the token’s scope until it expires or is actively revoked.
Why it matters
For CISOs, this campaign represents a meaningful escalation in the abuse of a network type that organisations rarely control but frequently allow staff to use. Business travel and conference attendance are constants across most industries, and the combination of a persistent RAT, an in-memory credential stealer, and an MFA-bypassing OAuth technique in a single campaign means a single employee connecting to a compromised hotel network can expose cloud tenancies, active sessions, and endpoint data simultaneously. The captive portal compromise also degrades the value of standard user vigilance — the prompts appear before users have consciously chosen to interact with anything suspicious. Organisations that have not addressed device code authentication flows are carrying a specific, documented exposure that adversaries at the state level are actively exploiting.
What to do now
- Disable the device code OAuth authentication flow in your Microsoft 365 tenant where operationally feasible, as this directly removes the mechanism exploited in the credential-harvesting strand of this campaign.
- Issue guidance to travelling staff to use personal hotspots or satellite internet connections in preference to public Wi-Fi at hotels and conference venues, consistent with Microsoft’s own recommendations.
- Train users to recognise ClickFix-style prompts — specifically, to never install software updates, drivers, or browser verifications triggered by a network login or captive portal page.
- Review OAuth token issuance and monitor for unexpected device code authentication attempts in Microsoft 365 audit logs, particularly for accounts belonging to staff who travel.
- Assess your endpoint detection coverage for in-memory PowerShell execution, as ChocoShell operates entirely in memory and will not leave a file artefact for traditional endpoint tools to detect.
- Consider passwordless authentication methods where possible, noting that Microsoft acknowledges device code phishing may bypass even passkeys, making flow-level disablement the stronger control.
