Midnight Blizzard, the Russian threat actor tied to the country’s foreign intelligence service, has spent months targeting users of public Wi-Fi networks at places like hotels and conference centers, according to new findings from Microsoft Threat Intelligence.
Overview of the CaptiveCrunch attack flow (Source: Microsoft)
Microsoft named the campaign CaptiveCrunch and identified two malware strains behind it, CornFlake and ChocoShell.
Building on earlier research from security firm ReliaQuest, published July 23, Microsoft ties this activity to Storm-2945, a sub-cluster of Midnight Blizzard.
Microsoft says the broader operation, which shows signs of AI assistance, dates back to February 2026, with the traffic manipulation piece observed since early May.
“Although our investigation into the initial compromise vector for the captive portal networks is ongoing, we have observed notable commonalities in the equipment and management systems used across multiple affected networks. These similarities suggest that the activity might not be limited to isolated compromises of individual venues and could reflect access to shared services within portions of the captive portal ecosystem,” Microsoft wrote.
By manipulating DNS and HTTP traffic on compromised captive portal networks, the attackers redirected victims down three paths. Two led to credential theft: phishing pages impersonating Microsoft 365 sign-in portals, and device code phishing pages abusing Microsoft Entra ID authentication flows.
The third displayed fake browser or operating system update pages that used the ClickFix social engineering method to persuade victims to download and run malware.
Microsoft also found ClickFix pages configured to push an APK file, suggesting the threat actor might be targeting Android devices too.
CornFlake and ChocoShell
Researchers describe CornFlake as a Windows RAT written in Go with a wide range of capabilities that include:
- Keylogging
- Clipboard monitoring
- Screenshot capture
- Audio surveillance
- Video surveillance
- Browser credential theft
- File exfiltration
- USB drive monitoring
- Security posture sweep
- Remote shell access
“On initial execution, CornFlake operates in dropper mode: it displays a convincing fake progress window designed to occupy the victim’s attention while the binary copies itself to %APPDATA%\svchost32\svchost32.exe and establishes persistence,” they added.
The second identified malware, ChocoShell, is an in-memory PowerShell credential stealer targeting browser cookies, saved passwords, Microsoft 365 and Azure AD tokens, and Wi-Fi credentials.
“Where CornFlake provides the operator with a persistent, long-running foothold on the device, ChocoShell is designed to extract the most operationally valuable credentials, giving the operator access to victim cloud environments,” Microsoft noted.
Researchers also discovered a web-based C2 panel, FruitStone, that Storm-2945 operators use to run the CaptiveCrunch infrastructure. Built as a single-page HTML and JavaScript application with no authentication on any of its functions, it gives operators a dashboard for managing compromised endpoints, building and deploying new payloads, and reviewing collected data such as screenshots, keystrokes, and browser credentials.
Recommendations
Microsoft recommends treating hotel and conference Wi-Fi as untrusted, using private cellular or managed connections where practical, and avoiding software updates or tools offered through captive portals.
Organizations are advised to review what information employees provide to hospitality providers when connecting to guest networks.
“Organizations should assume that public and hospitality network infrastructure might not be trustworthy and should adopt controls that limit exposure to traffic manipulation, credential theft, and device code phishing,” Microsoft concluded.
