CaptiveCrunch: Storm-2945 Hijacks Captive Portal Traffic for Credential Theft and Malware Delivery

Storm-2945 is a sub-cluster of Midnight Blizzard, a Russia-based threat actor linked to the Foreign Intelligence Service. Since early May 2026, it has used access to captive portal infrastructure at hotels, airports, and conference venues as an initial access vector to corporate travelers. Microsoft has not determined how the affected environments were accessed or compromised. When a victim connects to an affected network, the actor can intercept and manipulate the device’s traffic, enabling credential theft or malware delivery. The ultimate objective is access to the traveler’s corporate cloud environment rather than the venue itself. The scale of the activity suggests the actor may have gained access to shared services within the captive portal ecosystem, potentially exposing travelers from any organization using an affected network.

Using the access to captive portal, the actor manipulates DNS and HTTP traffic to redirect victims through actor-controlled systems. Victims may be sent to Microsoft-themed adversary-in-the-middle phishing pages, including device-code lures that trick them into authorizing the actor’s session and granting access and refresh tokens. Alternatively, the actor intercepts automated browser or operating-system connectivity checks to present fake updates, driver-repair notices, or verification prompts that lead to malware execution. Some landing pages also indicate possible Android targeting by instructing users to download and install an APK file. On Windows, the primary payload is CornFlake, a custom Go-based remote access trojan associated with Storm-2945 that establishes multiple persistence mechanisms and supports keylogging, clipboard capture, screenshots, audio and video recording, file theft, system discovery, removable-drive monitoring, and interactive shell access.

Storm-2945 also deploys ChocoShell, an in-memory PowerShell infostealer focused on credential theft. It disables script scanning, checks for sandbox environments, attempts several privilege-escalation techniques, and collects browser cookies and encryption keys, Microsoft 365 and Entra ID tokens, Web Account Manager tokens, Firefox data, and saved wireless credentials. Stolen data is packaged and sent over HTTPS using paths that resemble legitimate web traffic. Operations are managed through FruitStone, a web-based control panel disguised as a cloud infrastructure portal that provides live agent telemetry, campaign configuration, payload customization, obfuscation settings, and management of proxies, beacon profiles, and staging servers.