CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft

1. Executive summary

Since early May 2026, Microsoft has tracked an ongoing campaign dubbed "CaptiveCrunch" in which the actor Storm-2945 — assessed by Microsoft as a sub-cluster of Midnight Blizzard (APT29, MITRE G0016) — has manipulated DNS and HTTP traffic via compromised hospitality captive portals to redirect corporate travelers to adversary-in-the-middle (AitM) phishing infrastructure and deliver Windows malware. The campaign deploys two primary tools: the CornFlake RAT (a compiled Go backdoor with full surveillance capabilities) and the ChocoShell PowerShell infostealer, which strips browser cookies, Microsoft 365 SSO tokens, and Wi-Fi credentials. Attribution to Storm-2945 is unconfirmed in MITRE ATT&CK (no profile exists for this designation); the link to Midnight Blizzard rests solely on Microsoft's internal technical overlap assessment. EMEA financial services face direct risk to traveling staff whose corporate Entra ID credentials and M365 sessions can be harvested and replayed to access cloud email and data.

2. Regulatory framing

3. Technical analysis & attack chain

Attribution caveat: Microsoft attributes CaptiveCrunch to Storm-2945, described as a sub-cluster of Midnight Blizzard (APT29 / MITRE G0016). Storm-2945 has no MITRE ATT&CK profile; attribution is unconfirmed beyond Microsoft's internal assessment of TTP overlap with Storm-2372 (a known Midnight Blizzard initial-access sub-cluster). This advisory treats the Storm-2945 designation as a single-sourced vendor attribution.

Confirmed attack chain

1. Captive portal compromise (initial access to network infrastructure): Since early May 2026, Storm-2945 has manipulated DNS and HTTP traffic from networks served by captive portals at hospitality venues (hotels, conference centers, shared venues). Microsoft's investigation into the initial compromise vector for the captive portal equipment is ongoing. Notable commonalities in equipment and management systems across multiple affected networks suggest the actor may have access to shared services within the captive portal ecosystem rather than individual venue compromises. This detail is single-sourced to Microsoft.
2. Traffic redirection: The actor leverages their position on the captive portal network to intercept automated browser connectivity checks (NCSI probes) and redirect user traffic through actor-controlled infrastructure. Users are presented with what appears to be browser or OS update prompts delivered via ClickFix techniques — social-engineering lures that instruct the user to download and execute a file. ClickFix landing pages also include instructions for Android devices to install an APK, though Microsoft describes this as indicative rather than confirmed.
3. Device code phishing (parallel initial access vector): Since February 2026, and integrated into CaptiveCrunch since July 16, the actor redirects users to device code authentication flow experiences. Victims are instructed to enter an actor-controlled device code into a legitimate Microsoft sign-in page, authenticating the actor's session. This is consistent with prior Midnight Blizzard / Storm-2372 device code phishing operations tracked since August 2024. Doppelganger domains (ms365-device[.]com, ms365-live[.]com, m365-owa[.]com, owa-ms365[.]com) mimic Microsoft online services for AitM operations.
4. CornFlake RAT deployment: The primary payload is CornFlake, a full-featured Windows RAT written in Go. On execution, it operates in dropper mode, displaying a configurable fake progress window while copying itself to %APPDATA%\svchost32\svchost32.exe. Persistence is established through four redundant mechanisms: - Windows service registration: service named svchost32, display name "Cloud Sync Service", description "Synchronizes files with the cloud storage provider" - Registry Run keys - Named scheduled tasks - A persistence watchdog routine that continuously restores any removed persistence mechanism
5. CornFlake C2 communication: CornFlake performs an ECDH P-256 ephemeral key exchange with the C2 server, derives a session key via SHA-256, and communicates over a custom JSON protocol framed within the encrypted TLS channel. Each session uses a unique ephemeral key, making captured traffic undecryptable without the session-specific private key. Runtime configuration is stored in sync.dat, supporting hot reconfiguration of C2 servers, watched directories, file targeting patterns, and TLS settings without redeployment.
6. CornFlake capabilities (configuration-gated, selectively activated post-deployment): - Keylogging: Raw input API-based, captures all keystrokes including password fields - Clipboard monitoring: Captures clipboard changes with SHA-256 deduplication, records active window title - Screenshot capture: Idle-triggered and on-demand, configurable idle threshold - Audio surveillance: WASAPI-based microphone capture, encoded as WAV - Video surveillance: Media Foundation-based webcam capture, encoded as JPEG - Browser credential theft: ChromeKatz-derived module; live cookie extraction from Chromium process memory; stored password extraction from on-disk databases; Chrome App-Bound Encryption (ABE) bypass; Firefox NSS/SDR decryption - File exfiltration: Real-time filesystem monitoring, targets files by extension (Documents, Archives, Images, Code, Data, Emails, Keys), upload throttle of 1,000 files or 500 MB per cycle - USB drive monitoring: Detects and scans removable media on insertion - Security posture sweep: 18 categories of host intelligence including installed software, AV/EDR products, Defender exclusions, UAC level, RDP history, Office MRU files, credential hints - Remote shell: Arbitrary command execution via cmd.exe or PowerShell -NoP - Localhost HTTP API: Exposes /upload, /reload, /status endpoints for modular tasking by companion payloads (e.g., ChocoShell)
7. ChocoShell infostealer deployment: ChocoShell is a PowerShell-based infostealer delivered and executed entirely in-memory. It is tasked with high-volume theft of browser session cookies, saved passwords, M365 SSO tokens, and Wi-Fi credentials. Microsoft notes the script contains full developer comments referencing Microsoft detection signatures and evasion reasoning, with coding standards suggesting possible AI-assisted code generation.
8. ChocoShell execution and defense evasion: Upon execution, ChocoShell beacons to hardcoded C2 213.145.86[.]112. Evasion is performed in sequence: - AMSI disabled via .NET reflection to prevent ScriptBlock scanning - Evasion of Microsoft behavioral detection on suspicious PowerShell web-request cmdlets - Timing-based sandbox/VM detection check — silently exits if VM detected
9. ChocoShell privilege escalation: Requires administrative privileges for SYSTEM token impersonation, VSS shadow copy creation, and Defender signature locking. Implements three silent UAC bypass techniques with ordered fallback. If all silent bypasses fail (user is not a local admin), falls back to a visible UAC prompt via Start-Process -Verb RunAs. A variant exists designed to execute within the WinGet DSC host process (ConfigurationRemotingServer), suggesting a vector through malicious WinGet DSC configuration in Windows machine provisioning.
10. ChocoShell credential and session theft (elevated):
    • Chromium browsers (Chrome, Edge, Brave, Opera, Opera GX, Vivaldi): Extracts master encryption key from browser Local State file; handles both ABE (Chrome v127+) and legacy DPAPI schemes. SYSTEM-level DPAPI access obtained by impersonating a SYSTEM process token from winlogon.exe, wininit.exe, or services.exe. Locked SQLite databases accessed via shared file access, VSS snapshots, or direct copy fallback.
    • Chrome DevTools Protocol (CDP) bypass: Launches Chrome, Edge, and Brave with –remote-debugging-port flag and issues Network.getAllCookies via CDP — completely bypasses ABE by having the browser perform its own decryption. Transient scheduled tasks with TASK_LOGON_INTERACTIVE_TOKEN launch the browser under the signed-in user's session to resolve token inheritance issues. After extraction, browser is stopped and relaunched with –restore-last-session to avoid user alerting.
    • Firefox family (Firefox, Waterfox, LibreWolf, Floorp, Zen): Copies unencrypted cookies.sqlite from each profile.
    • Microsoft 365 / Azure AD tokens: Collects access tokens, refresh tokens, and WAM tokens from .tbres files in the Token Broker cache — enables SSO session replay without browser cookies.
    • Wi-Fi credentials: Harvested via netsh wlan show profile with key=clear.
11. ChocoShell exfiltration and cleanup: All collected data is aggregated into JSON, GZip-compressed, Base64-encoded, and POSTed to the C2 /t/event endpoint. Post-exfiltration: collected data variables nulled, garbage collection forced, VSS shadow copies deleted via WMI, temporary elevation scripts removed, UAC bypass registry keys verified removed.
12. FruitStone C2 panel: The web-based management panel is a single-page application (HTML/JavaScript) with all functionality exposed without authentication. Branded as "CloudSync Console" with footer "Acuity Systems, Inc. — Cloud Infrastructure Portal v3.2.1." Uses JWT-based authentication, session revocation, rate limiting with IP blocking. Displays all registered CornFlake agents with real-time status via SSE, grouped by country and subnet. Includes a campaign builder wizard for configuring and building new CornFlake payloads from the panel.

AI augmentation: Microsoft reports Storm-2945 has leveraged AI to support a significant portion of operations, including phishing content and potentially ChocoShell code generation. Anthropic and OpenAI collaborated with Microsoft on this investigation.

4. Mitigation & containment

P1 — Within 24 hours

• Block known C2 and AitM infrastructure at firewall, proxy, and DNS resolver layers:
• IPs: 31.57.243[.]154, 38.146.28[.]75, 38.146.28[.]132, 104.194.159[.]150, 107.189.26[.]194, 213.145.86[.]112
• Domains: ms365-device[.]com, ms365-live[.]com, m365-owa[.]com, owa-ms365[.]com
• Hunt for CornFlake RAT presence: Search endpoints for %APPDATA%\svchost32\svchost32.exe, Windows service named svchost32 (display name "Cloud Sync Service"), and the sync.dat configuration file. Query registry for HKLM\SYSTEM\CurrentControlSet\Services\svchost32 with DisplayName "Cloud Sync Service" or Description "Synchronizes files with the cloud storage provider".
• Hunt for ChocoShell execution: Search PowerShell logs (Event ID 4104) for AMSI disable via reflection, –remote-debugging-port, Network.getAllCookies, netsh wlan show profile with key=clear, and beaconing to /t/pixel.gif?m= or /cdn/chunks/polyfill-7e2b.min.js.
• Block and revoke Entra ID sessions for any users known to have traveled and connected to hospitality Wi-Fi since May 2026 — focus on token revocation, not just password reset, given .tbres token theft.
• Conditional Access policy enforcement: Block device code flow for users who do not require it; restrict Entra ID device registrations to managed/compliant devices only.

P2 — Within 72 hours

• Travel security advisory: Issue guidance to all staff, especially traveling executives, to treat hotel, conference, airport, and guest wireless networks as untrusted. Advise use of corporate VPN before any browser or authentication activity on guest networks.
• EDR detection rules: Deploy detection for the specific TTPs:
• Process creation at %APPDATA%\svchost32\svchost32.exe
• Scheduled task creation with TASK_LOGON_INTERACTIVE_TOKEN launching browsers with –remote-debugging-port
• Browser processes launched with –remote-debugging-port flag
• PowerShell execution with -NoP flag from non-standard paths
• AMSI tamper events
• File creation within 2 minutes of NCSI connectivity check (see Microsoft advanced hunting query in source)
• Review Entra ID sign-in logs: Query for anomalous OAuth device code authentication activity, sign-ins from 213.145.86[.]112 and other listed IPs, and device registrations from non-corporate devices or unusual geographies.
• Defender exclusions audit: CornFlake's posture sweep collects Defender exclusions — audit for overly broad exclusions that may facilitate persistence.

P3 — Within 7 days

• Captive portal policy: Review what information employees provide to hospitality providers when connecting to guest networks. Assess whether corporate travel policy should mandate VPN-before-auth on all untrusted networks.
• WinGet DSC hardening: Given the ChocoShell variant targeting ConfigurationRemotingServer, review WinGet DSC configuration policies and restrict execution of untrusted DSC configurations in provisioning workflows.
• Browser hardening: Consider deploying policies that disable –remote-debugging-port for managed browsers; evaluate Chrome ABE effectiveness (Chrome v127+) and ensure managed browsers are current.
• Threat intel feed update: Add all listed IOCs to SIEM/SOC watchlists; configure Microsoft Sentinel TI Map analytics or equivalent for automated matching.

5. Indicators of compromise

domain  ms365-device[.]com
domain  ms365-live[.]com
domain  m365-owa[.]com
domain  owa-ms365[.]com
ipv4  31.57.243[.]154
ipv4  38.146.28[.]75
ipv4  38.146.28[.]132
ipv4  104.194.159[.]150
ipv4  107.189.26[.]194
ipv4  213.145.86[.]112
sha256  918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593
sha256  be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c
url  hxxps://213.145.86[.]112/t/pixel.gif?m=
url  hxxps://213.145.86[.]112/cdn/chunks/polyfill-7e2b.min.js
url  hxxps://213.145.86[.]112/t/event

6. Detection

rule CornFlake_RAT_CaptiveCrunch {
  meta:
    author = "Adverse Trace"
    date = "2026-07-31"
    reference = "https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/"
    description = "Detects CornFlake RAT artifacts from CaptiveCrunch campaign"

  strings:
    $svc_name = "svchost32" ascii
    $svc_display = "Cloud Sync Service" ascii
    $svc_desc = "Synchronizes files with the cloud storage provider" ascii
    $config_file = "sync.dat" ascii
    $path1 = "\\svchost32\\svchost32.exe" ascii
    $path2 = "%APPDATA%\\svchost32" ascii
    $panel_brand = "CloudSync Console" ascii
    $panel_footer = "Acuity Systems, Inc." ascii

  condition:
    3 of them
}

rule ChocoShell_Infostealer_CaptiveCrunch {
  meta:
    author = "Adverse Trace"
    date = "2026-07-31"
    reference = "https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/"
    description = "Detects ChocoShell PowerShell infostealer artifacts from CaptiveCrunch campaign"

  strings:
    $beacon_path = "/t/pixel.gif?m=" ascii
    $polyfill_path = "/cdn/chunks/polyfill-7e2b.min.js" ascii
    $exfil_path = "/t/event" ascii
    $cdp_cmd = "Network.getAllCookies" ascii
    $debug_flag = "--remote-debugging-port" ascii
    $restore_flag = "--restore-last-session" ascii
    $wlan_cmd = "netsh wlan show profile" ascii
    $key_clear = "key=clear" ascii
    $token_cache = ".tbres" ascii
    $task_logon = "TASK_LOGON_INTERACTIVE_TOKEN" ascii
    $dsc_host = "ConfigurationRemotingServer" ascii

  condition:
    4 of them
}

title: CaptiveCrunch CornFlake RAT Service Registration
id: AT-2026-07-31-447-001
status: experimental
author: Adverse Trace
date: 2026/07/31
description: Detects CornFlake RAT Windows service registration matching CaptiveCrunch campaign
references:

  - https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/
logsource:
  product: windows
  service: registry
detection:
  selection_service_name:
    EventID: 4657
    ObjectName|contains: '\SYSTEM\CurrentControlSet\Services\svchost32'
  selection_display:
    ValueName: DisplayName
    ValueData: 'Cloud Sync Service'
  selection_description:
    ValueName: Description
    ValueData: 'Synchronizes files with the cloud storage provider'
  condition: selection_service_name and (selection_display or selection_description)
falsepositives:

  - None expected; service name and description are deliberately unique
level: high

---
title: CaptiveCrunch CornFlake RAT Process Execution
id: AT-2026-07-31-447-002
status: experimental
author: Adverse Trace
date: 2026/07/31
description: Detects CornFlake RAT binary executing from its persistence path
references:

  - https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith: '\svchost32\svchost32.exe'
  condition: selection
falsepositives:

  - None expected; legitimate svchost.exe does not run from this path
level: high

---
title: CaptiveCrunch ChocoShell Browser Debug Port Launch
id: AT-2026-07-31-447-003
status: experimental
author: Adverse Trace
date: 2026/07/31
description: Detects browser launched with remote debugging port flag, consistent with ChocoShell CDP cookie theft
references:

  - https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/
logsource:
  product: windows
  category: process_creation
detection:
  selection_browser:
    Image|endswith:

      - '\chrome.exe'
      - '\msedge.exe'
      - '\brave.exe'
  selection_flag:
    CommandLine|contains: '--remote-debugging-port'
  condition: selection_browser and selection_flag
falsepositives:

  - Legitimate developer debugging (rare in enterprise)
level: high

---
title: CaptiveCrunch ChocoShell C2 Beacon
id: AT-2026-07-31-447-004
status: experimental
author: Adverse Trace
date: 2026/07/31
description: Detects ChocoShell C2 beacon to /t/pixel.gif path
references:

  - https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/
logsource:
  product: windows
  category: network_connection
detection:
  selection:
    DestinationIp:

      - '213.145.86.112'
    DestinationPort: 443
  filter_path:
    Image|endswith:

      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
  condition: selection and not filter_path
falsepositives:

  - Unlikely; IP is dedicated C2 infrastructure
level: critical

Threat actor context

APT29 · G0016 · aka IRON RITUAL, IRON HEMLOCK, NobleBaron, Dark Halo, NOBELIUM

APT29 is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR). They have operated since at least 2008, often targeting government networks in Europe and NATO member countries, research institutes, and think tanks. APT29 reportedly compromised the Democratic National Committee starting in the summer of 2015. …

No MITRE ATT&CK profile for: Storm-2945.

7. Sources

• Microsoft Security Blog, "CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft," https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/, 2026-07-31
• ReliaQuest (referenced by Microsoft), reporting on doppelganger domains and AitM phishing operations, 2026-07-23

8. Adverse Trace position

This is an active, ongoing campaign with high direct relevance to EMEA financial services. The attack chain is well-developed: captive portal traffic manipulation provides a credible initial access vector that bypasses traditional corporate network controls by targeting traveling staff on untrusted hospitality networks. The CornFlake RAT is a mature, rapidly iterating Go implant with comprehensive surveillance capabilities and robust persistence — the watchdog routine that restores removed persistence mechanisms is a notable operational challenge for responders. ChocoShell's token theft from .tbres files is the most strategically significant capability: M365 SSO token replay enables cloud email and data access without requiring browser cookies, meaning standard "revoke browser sessions" remediation is insufficient — full token revocation and conditional access re-evaluation are required. Attribution to Storm-2945 / Midnight Blizzard is single-sourced to Microsoft and unconfirmed in MITRE ATT&CK; the TTP overlap with Storm-2372 device code phishing is consistent but not independently corroborated. We are treating this as a high-severity threat to traveling personnel and recommend clients prioritize P1 containment actions immediately, with particular emphasis on Entra ID token revocation for recent travelers and conditional access hardening against device code flow abuse. We will update this advisory if the captive portal compromise vector is identified or if additional IOCs emerge.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.