Severity
High
Analysis Summary
Since early May 2026, Threat Intelligence firm has observed Storm-2945, assessed as an operational sub-cluster of the Russia-based Midnight Blizzard, conducting targeted traffic manipulation attacks against hospitality and other networks using captive portals. The campaign, tracked as CaptiveCrunch, has compromised Wi-Fi infrastructure across several countries, including hotels, conference centers, and shared venues.
The activity is assessed to target corporate travelers by redirecting their traffic through attacker-controlled infrastructure. Researchers also observed AI-augmented operations and earlier device-code and OAuth phishing campaigns targeting Microsoft Entra ID and Microsoft 365.
Storm-2945 leverages an adversary-in-the-middle position to deliver phishing pages and malware disguised as legitimate browser or operating-system updates. The campaign uses ClickFix-style social engineering, convincing users to perform malicious commands or download files. Researchers has also identified indications of similar techniques targeting Android devices through malicious APK installation instructions.
The primary malware, CornFlake, is a Go-based Windows RAT that provides persistent access and extensive surveillance capabilities. It can establish persistence through Windows services, Registry Run keys, scheduled tasks, and a watchdog mechanism. Its capabilities include keylogging, clipboard monitoring, screenshots, microphone and webcam surveillance, browser credential theft, file exfiltration, USB monitoring, system reconnaissance, and remote shell execution. CornFlake uses encrypted C2 communications with ephemeral ECDH keys to protect its traffic.
Storm-2945 also deploys ChocoShell, an in-memory PowerShell infostealer focused on browser cookies, saved passwords, Microsoft 365 SSO tokens, Azure AD tokens, and Wi-Fi credentials. It employs AMSI bypasses, sandbox detection, multiple UAC bypass techniques, and covert HTTPS-based C2 communications. Stolen information is compressed, encoded, and exfiltrated before cleanup activities remove temporary artifacts.
The operators manage compromised systems through FruitStone, a web-based C2 platform capable of endpoint management, remote shell access, file collection, screenshots, keylogging, credential extraction, configuration changes, payload generation, and infrastructure management.
The campaign also incorporates device-code phishing, tricking victims into entering attacker-controlled codes on legitimate Microsoft authentication pages, allowing attackers to authenticate their own sessions using the victim’s credentials.
Organizations should treat public Wi-Fi as untrusted, prefer cellular or secured connectivity, avoid software updates prompted through captive portals, educate users about ClickFix attacks, enforce phishing-resistant MFA and Conditional Access, and restrict device-code authentication where possible.
Impact
- Credentials Theft
- Privilege Escalation
- Command Execution
- Unauthorized Access
- Sensitive Data Exposure
Indicators of Compromise
Domain Name
- cdn-gstat.com
- ms365-device.com
- ms365-live.com
- m365-owa.com
- owa-ms365.com
IP
- 31.57.243.154
- 38.146.28.75
- 38.146.28.132
- 104.194.159.150
- 107.189.26.194
- 213.145.86.112
MD5
fba867df17721879df9d8dcca68d6900
c6f4df18cb880500f3921a179c3a3766
SHA-256
918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593
be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c
SHA1
510af9bb00ff5d4a6856b1291af55db9f6e13551
937e75e0e1c82eecab69e9b8ad481bd7e0845308
Remediation
- Block identified malicious IP addresses, domains, file hashes, and other CaptiveCrunch-related IOCs across firewalls, DNS, proxy, EDR, and email security controls.
- Continuously update IOC blocklists using validated threat-intelligence feeds to detect newly identified Storm-2945 infrastructure.
- Treat public and hotel Wi-Fi networks as untrusted and use cellular data or secured networks for sensitive activities.
- Avoid installing software updates, browser extensions, or APKs prompted through captive portals; download updates only from official vendor sources.
- Enforce phishing-resistant MFA and restrict or disable device-code authentication where operationally feasible.
- Implement Microsoft Entra ID Conditional Access policies based on device compliance, trusted locations, and sign-in risk.
- Monitor Microsoft 365 and Entra ID for suspicious device-code authentication, OAuth activity, anomalous sign-ins, and unauthorized session activity.
- Deploy EDR and monitor for PowerShell abuse, AMSI bypasses, suspicious persistence, unauthorized remote shells, and RAT activity.
- Monitor and restrict unauthorized services, scheduled tasks, Registry Run keys, and other persistence mechanisms.
- Monitor access to browser credentials, cookies, SSO tokens, Azure AD tokens, and Wi-Fi credentials for abnormal extraction activity.
- Monitor outbound HTTPS traffic for connections to suspicious or unauthorized C2 infrastructure.
- Educate users about ClickFix-style attacks and instruct them not to execute commands, paste scripts, or install software based on webpage instructions.
- Restrict unauthorized APK sideloading and monitor endpoints for suspicious mobile application installations.
- Segment guest and corporate wireless networks to prevent compromised guest infrastructure from reaching internal resources.
- Keep operating systems, browsers, security tools, and endpoint protection solutions fully patched and updated.