CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft

What Happened

A Russian state-linked hacking group is targeting people who use public Wi-Fi at hotels, conference centers, and similar venues around the world. The attackers manipulate the Wi-Fi login pages (captive portals) to redirect users to fake websites that look like legitimate software updates or security checks. When users follow the on-screen instructions, they unknowingly download and install malicious software that can record keystrokes, take screenshots, activate cameras and microphones, steal passwords and online session tokens, and copy files from the device. The attackers also trick users into entering special codes on real Microsoft sign-in pages, which gives the attackers access to the users' work accounts. Anyone traveling and using guest Wi-Fi networks is potentially affected. This matters because the stolen credentials and access tokens can be used to break into corporate email and cloud services. Travelers should avoid downloading updates or running scripts from Wi-Fi login pages, use mobile hotspots instead of public Wi-Fi, and organizations should block device code authentication where possible and require phishing-resistant multi-factor authentication.

Key Takeaways

• Storm-2945, a sub-cluster of Midnight Blizzard, is manipulating DNS and HTTP traffic from captive portal networks at hospitality venues worldwide to redirect travelers to malware delivery and phishing infrastructure
• Two primary malware tools are deployed: CornFlake, a full-featured Go-based Windows RAT with keylogging, screen capture, audio/video surveillance, browser credential theft, and file exfiltration capabilities, and ChocoShell, an in-memory PowerShell infostealer targeting browser cookies, passwords, M365 SSO tokens, and Wi-Fi credentials
• ChocoShell employs multiple UAC bypass techniques (SilentCleanup, wsreset.exe, sdclt.exe COM hijacks), AMSI disabling, and Chrome DevTools Protocol-based cookie extraction to bypass Chrome App-Bound Encryption
• The campaign also integrates device code authentication flow phishing to compromise Microsoft Entra ID identities, consistent with prior Midnight Blizzard operations
• Threat actor leverages AI to support a significant portion of operations including social engineering content and potentially code generation for ChocoShell

Affected Systems

• Windows systems targeted by CornFlake RAT and ChocoShell infostealer
• Android devices potentially targeted via APK delivery through ClickFix lures
• Microsoft Entra ID / Microsoft 365 environments via device code phishing
• Hospitality sector captive portal networks (hotels, conference centers, shared venues)
• Chromium-based browsers (Chrome, Edge, Brave, Opera, Opera GX, Vivaldi) and Firefox family browsers (Firefox, Waterfox, LibreWolf, Floorp, Zen)

Vulnerabilities (CVEs)

None identified.

Attack Chain

1. Initial Access: Storm-2945 manipulates DNS and HTTP traffic from captive portal networks at hospitality venues to redirect travelers to attacker-controlled infrastructure
2. Execution: ClickFix social engineering lures present fake browser/OS update prompts instructing users to paste and run clipboard content via PowerShell/Terminal, delivering CornFlake RAT and ChocoShell infostealer
3. Persistence: CornFlake copies itself to %APPDATA%\svchost32\svchost32.exe, registers as Windows service 'svchost32' (Cloud Sync Service), creates Registry Run keys, scheduled tasks, and a persistence watchdog routine
4. Defense Evasion: ChocoShell disables AMSI via .NET reflection, performs timing-based VM detection, and locks Defender signature updates; CornFlake uses ECDH P-256 encrypted C2 with ephemeral keys
5. Credential Access: ChocoShell extracts browser cookies and passwords via Chrome DevTools Protocol and DPAPI/SYSTEM token impersonation, harvests M365/Azure AD tokens from Token Broker cache, and collects Wi-Fi credentials via netsh
6. Exfiltration: Stolen data is GZip-compressed, Base64-encoded, and POSTed to C2 /t/event endpoint; CornFlake exfiltrates files based on extension targeting with upload throttling

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: Yes
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: Yes
• Platforms: Microsoft Defender XDR Advanced Hunting, Microsoft Sentinel ASIM

The article provides multiple KQL advanced hunting queries for Microsoft Defender XDR (file creation after NCSI connectivity test, Storm-2945 infrastructure connectivity, CornFlake RAT binary and service detection) and ASIM-based queries for Microsoft Sentinel (network IP/domain IOC detection, web session hash/URL detection, ChocoShell C2 communication detection). No YARA, Sigma, Snort, or Suricata rules are provided.

Detection Engineering Assessment

Required Log Sources

• DeviceProcessEvents (process creation, command lines)
• DeviceRegistryEvents (registry modifications for persistence and UAC bypass)
• DeviceFileEvents (file creation in %APPDATA%\svchost32)
• DeviceNetworkEvents (connections to known C2 IPs and domains)
• Microsoft Entra ID sign-in logs (device code authentication events)
• Microsoft Entra ID Protection anomaly alerts
• DNS query logs (captive portal redirect detection)
• Windows Event Log — Scheduled Task creation (Event ID 4698)
• AMSI telemetry (PowerShell script block logging)

Hunting Hypotheses

Control Gaps

• Network-level controls may not detect CornFlake C2 traffic due to ECDH encryption and SNI spoofing of legitimate domains like teams.microsoft.com
• AMSI bypass via .NET reflection may prevent script-level detection of ChocoShell by solutions relying solely on AMSI for PowerShell inspection
• Chrome DevTools Protocol-based cookie extraction bypasses browser-level App-Bound Encryption, which many browser security controls are designed to protect
• Captive portal traffic manipulation occurs upstream of the endpoint, potentially evading endpoint-based initial access controls before malware delivery
• In-memory execution of ChocoShell and its downloaded modules may evade file-based scanning and static analysis

Key Behavioral Indicators

• Process creating executable at %APPDATA%\svchost32\svchost32.exe — mimics legitimate svchost.exe in a non-standard path
• Windows service registration with name 'svchost32', display name 'Cloud Sync Service', or description 'Synchronizes files with the cloud storage provider'
• Browser processes (chrome.exe, msedge.exe, brave.exe) launched with --remote-debugging-port flag from non-standard parent processes or scheduled tasks
• Registry modifications to HKCU\Environment\windir followed by SilentCleanup scheduled task execution within a short time window
• PowerShell process with -NoP flag (suppressing profile loading) as a child of svchost32.exe or other suspicious parent
• Network connections to IPs with URI paths /t/pixel.gif, /cdn/chunks/polyfill-7e2b.min.js, or /t/event
• File creation of sync.dat in same directory as suspicious executable in %APPDATA%
• Transient scheduled tasks created with TASK_LOGON_INTERACTIVE_TOKEN launching browser processes

False Positive Assessment

Recommendations

Immediate Mitigation

Infrastructure Hardening

• Evaluate whether your network security controls can inspect and alert on HTTPS traffic to the identified C2 IP with specific URI paths (/t/pixel.gif, /cdn/chunks/polyfill-7e2b.min.js, /t/event), even when SNI is spoofed to legitimate domains.
• Consider implementing conditional access policies that restrict authentication to trusted locations and devices, and evaluate requiring phishing-resistant MFA (such as passkeys) for all users, especially those who travel.
• If supported by your identity provider, consider implementing sign-in risk policies that automatically block or challenge authentication requests from unfamiliar locations or device contexts.
• Evaluate whether your organization's MDM solution can restrict Wi-Fi connections to provisioned networks only, preventing automatic or manual connection to unmanaged guest networks on corporate devices.

User Protection

• Consider distributing guidance to traveling employees to prefer mobile hotspots, eSIM cellular data, or enterprise-managed travel routers over public Wi-Fi at hotels, conferences, and airports.
• Advise users to verify any software update or security check prompts through trusted operating system mechanisms rather than web pop-ups or captive portal pages, and to treat any paste-and-run instructions as malicious.
• If applicable, consider providing enterprise-managed travel routers or hotspot devices that establish encrypted tunnels back to corporate infrastructure before accessing sensitive resources.
• Evaluate whether your endpoint protection can detect and block ClickFix-style social engineering attacks that instruct users to execute clipboard content via PowerShell or Windows Terminal.

Security Awareness

• Consider incorporating ClickFix social engineering awareness into existing security training programs, emphasizing that legitimate software updates never require users to manually paste and run scripts in terminal windows.
• Educate users on the risks of captive portal networks and the importance of not entering corporate credentials on hotel, conference, or guest network registration pages.
• Consider adding device code phishing awareness to security training, advising users to be suspicious of any authentication prompt that asks them to enter a code at a Microsoft sign-in page when they did not initiate the sign-in themselves.
• If your organization has travelers, consider briefing them before trips on the specific risk of traffic manipulation on guest networks and the recommendation to use alternative connectivity methods.

MITRE ATT&CK Mapping

Additional IOCs

• Urls:
  • 213.145.86.112/t/pixel.gif - ChocoShell C2 beacon URI path mimicking an image tracking pixel; uses /t/pixel.gif?m=<status> format
  • 213.145.86.112/cdn/chunks/polyfill-7e2b.min.js - ChocoShell additional tooling download URI disguised as a JavaScript polyfill file; Base64-decoded and executed in memory for browser encryption key extraction
  • 213.145.86.112/t/event - ChocoShell exfiltration endpoint; receives GZip-compressed, Base64-wrapped JSON containing stolen credentials and session tokens via POST
• File Hashes:
  • 918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593 (SHA256) - File hash associated with Storm-2945 CaptiveCrunch campaign activity
  • be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c (SHA256) - File hash associated with Storm-2945 CaptiveCrunch campaign activity
• Registry Keys:
  • HKCU\Environment\windir - ChocoShell SilentCleanup UAC bypass — writes malicious command to windir environment variable, triggers SilentCleanup scheduled task which resolves %windir% from user environment at elevated privilege; cleaned up after two seconds
  • HKCU\Software\Classes - ChocoShell wsreset.exe COM hijack — creates a COM handler key to hijack the auto-elevating Windows Store reset tool for privilege escalation
  • HKCU\Software\Classes\Folder\shell\open\command - ChocoShell sdclt.exe folder hijack — hijacks Folder shell open command to launch Windows Backup utility with /KickOffElev flag for privilege escalation
  • HKLM\SYSTEM\CurrentControlSet\Services\svchost32 - CornFlake RAT Windows service registration with DisplayName 'Cloud Sync Service' and Description 'Synchronizes files with the cloud storage provider'
• File Paths:
  • %APPDATA%\svchost32\svchost32.exe - CornFlake RAT binary dropped to disk and executed; deliberately mimics legitimate svchost.exe process name
  • sync.dat - CornFlake runtime configuration file supporting hot reconfiguration of C2 servers, watched directories, file targeting patterns, and TLS settings
• Command Lines:
  • Purpose: Wi-Fi credential harvesting via netsh | Tools: netsh.exe | Stage: Credential Access | netsh wlan show profile
  • Purpose: UAC bypass fallback via elevated process launch | Tools: PowerShell | Stage: Privilege Escalation | Start-Process -Verb RunAs
• Other:
  • svchost32 - CornFlake RAT Windows service name with display name 'Cloud Sync Service' and description 'Synchronizes files with the cloud storage provider' — deliberately mimics legitimate svchost.exe
  • chrome_update.exe - Filename observed on C2 staging server for CornFlake payload deployment