Microsoft Threat Intelligence has uncovered CaptiveCrunch, a cyber espionage campaign linked to Storm-2945, a subgroup of Midnight Blizzard, the Russian state-linked threat actor associated with Russia’s Foreign Intelligence Service (SVR).
Active since early May 2026, the operation targets business travelers by exploiting hospitality Wi-Fi networks and captive portals in hotels, conference centers, and similar venues. The campaign combines adversary-in-the-middle attacks, phishing, malware deployment, and AI-assisted development to steal credentials and infiltrate enterprise environments.
Storm-2945 Uses Hospitality Networks to Target Travelers
According to Microsoft, Storm-2945 manipulates DNS and HTTP traffic on public Wi-Fi networks using captive portals. By intercepting users before they reach legitimate websites, attackers redirect victims to malicious infrastructure that hosts fake Microsoft sign-in pages or malware downloads.
This approach allows the Midnight Blizzard campaign to compromise users without requiring them to intentionally visit suspicious websites. Microsoft believes the attackers may have gained access to shared captive portal infrastructure used across multiple hospitality providers, expanding the scale of the CaptiveCrunch operation beyond isolated venues.
Credential Theft and Malware Deployment
A key objective of CaptiveCrunch is stealing Microsoft Entra ID credentials. Researchers observed Storm-2945 using counterfeit Microsoft login pages and device code phishing to gain unauthorized access to Microsoft 365 accounts. Once authentication succeeds, the attackers register compromised devices and collect cloud data, making corporate travelers especially attractive targets.
The campaign also distributes malware disguised as browser or operating system updates through convincing “ClickFix” prompts that encourage users to run scripts or install software. Similar tactics have targeted Android users by prompting them to download malicious APK files.
The primary payload is CornFlake, a Windows remote access trojan written in Go that installs itself as a persistent “Cloud Sync Service.” It maintains persistence through Windows services, registry keys, and scheduled tasks while enabling attackers to log keystrokes, capture screenshots, monitor clipboard activity, record webcam and microphone data, steal browser credentials, exfiltrate files, monitor USB devices, and execute remote commands through PowerShell or Windows Command Prompt. Communications with command-and-control servers are encrypted to evade analysis.
AI-Assisted Malware and Centralized Control
Supporting CornFlake is ChocoShell, a PowerShell-based infostealer that operates entirely in memory to avoid detection. It extracts browser passwords, Microsoft 365 Single Sign-On tokens, Azure Active Directory authentication tokens, Wi-Fi credentials, and session cookies while bypassing AMSI, User Account Control, and virtual analysis environments. Microsoft researchers noted that ChocoShell’s source code contains detailed developer comments, suggesting significant AI-assisted development.
The attackers manage infected systems through FruitStone, a web-based command-and-control platform that allows operators to deploy malware, execute remote commands, collect stolen credentials, review screenshots and keystrokes, configure campaigns, and organize compromised devices by geography and operational status.
Microsoft’s Defensive Guidance
Microsoft assesses with high confidence that Storm-2945 operates as part of Midnight Blizzard because of overlaps in tooling, phishing techniques, victim selection, and cloud exploitation methods. The Russian state-linked threat actor has previously targeted governments, diplomatic organizations, NGOs, IT providers, and other strategic sectors.
To reduce exposure to CaptiveCrunch, Microsoft recommends treating public Wi-Fi as untrusted, enforcing phishing-resistant multi-factor authentication or passkeys, restricting OAuth permissions, monitoring device registrations, and applying Conditional Access policies.
Organizations should also educate employees about ClickFix-style social engineering and avoid installing software, certificates, or updates delivered through captive portals. Business travelers are encouraged to use trusted VPNs, mobile hotspots, or enterprise-managed travel routers whenever possible.
