Loading story…
Microsoft linked the CaptiveCrunch campaign to Storm-2945, a subgroup of the Russian state-backed Midnight Blizzard actor, after attackers compromised captive portal ecosystems used by hospitality organizations and other shared public venues. By manipulating DNS and HTTP traffic on public Wi-Fi gateway infrastructure, the group conducted adversary-in-the-middle (AiTM) attacks that intercepted login flows and stole Microsoft 365 credentials from traveling employees across multiple sectors.
The operation also pushed follow-on malware and phishing lures through the hijacked portals. Victims were shown fake browser update prompts delivering malware including CornFlake and ChocoShell, alongside ClickFix-style social engineering and malicious Android APK prompts; some recent landing pages also added device code phishing, a technique Microsoft said Midnight Blizzard has used since 2024. The campaign has reportedly been active since May and focused on hospitality-linked networks and other public access environments where users expect captive portal authentication.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
Microsoft said CaptiveCrunch operators may redirect Android users on targeted captive portals to download malicious APK files. The warning expanded the campaign's known impact from credential theft to possible persistent compromise of Android devices, including credential harvesting and activity monitoring.
Microsoft said Storm-2945 began manipulating DNS and HTTP traffic from captive portal networks in May 2026. The campaign targeted hospitality-related and other shared-venue Wi-Fi environments to steal Microsoft 365 credentials using adversary-in-the-middle techniques.
Microsoft said phishing OAuth activity associated with the CaptiveCrunch campaign was observed as early as February 2026, predating the captive-portal traffic-manipulation phase. This indicates the operation was active in an earlier credential-theft stage before the May 2026 Wi-Fi manipulation activity.
Microsoft said the device code phishing activity seen in recent CaptiveCrunch landing pages is consistent with Midnight Blizzard operations previously reported since August 2024.
Microsoft discovered an unprotected web-based management panel called FruitStone used by the CaptiveCrunch operators to manage infected systems. The panel allowed browsing victim files, executing PowerShell commands, and capturing screenshots and keystrokes.
Microsoft attributed the public Wi-Fi gateway credential theft campaign dubbed CaptiveCrunch to Storm-2945, a subgroup of the Russian state-linked Midnight Blizzard threat actor. It also reported widespread compromise of captive-portal-serviced networks in several countries and described malware including CornFlake and ChocoShell.
Microsoft said that over the prior two weeks, some CaptiveCrunch landing pages redirected victims to Microsoft device code authentication flow experiences. The pages instructed victims to enter device codes to authenticate the threat actor's session.
ReliaQuest observed attackers modifying DNS configurations on compromised SOHO routers to redirect users to attacker-controlled infrastructure. SecurityWeek reported this was flagged roughly a week before Microsoft's attribution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
13 references tracked. Mallory keeps watching after this page renders.
ghacks.net
Open sourcecysecurity.news
Open sourcescworld.com
Open sourcemalware.news
Open sourcesecurityweek.com
Open sourcecyberveille.ch
Open sourcethreats.wiz.io
Open sourcepushsecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft Threat Intelligence and Zscaler reported that **Storm-2945**, a sub-cluster of **Midnight Blizzard / APT29** linked to Russia, has been compromising shared captive-portal infrastructure at hotels, conference centers, and similar venues to intercept traveler traffic and steal **Microsoft 365** credentials. The operation, dubbed **CaptiveCrunch**, manipulates DNS and HTTP flows to redirect victims from legitimate Wi-Fi login pages to attacker-controlled phishing and malware-delivery sites, including lures for **Microsoft Entra ID device code phishing** and **ClickFix-style** fake updates. Activity has been observed in multiple U.S. cities as well as India and Saudi Arabia, indicating a broad campaign aimed at travelers across sectors. Researchers said the campaign deploys multiple payloads after credential theft, including **CornFlake**, a Go-based Windows RAT used for persistence and surveillance, and **ChocoShell**, an in-memory PowerShell stealer designed to collect browser secrets, Microsoft 365 and Azure AD/WAM tokens, and Wi-Fi credentials. The operation has also expanded to Android through malicious APKs, and Microsoft assessed that AI-assisted tooling supported parts of the intrusion set, including development of CornFlake and ChocoShell. The reporting indicates the attackers are using trusted hospitality network infrastructure as an initial access vector to harvest identities and extend compromise onto victim devices.
Aug 17, 2026
Microsoft reported that social-engineering lures are increasingly being used to trick users into launching malware themselves, with the **ClickFix** technique emerging as a major delivery method across phishing, malvertising, and compromised websites. In ClickFix attacks, victims are shown fake CAPTCHA, verification, or repair prompts that copy malicious commands to the clipboard and persuade them to run them, often leading to fileless execution through LOLBins, obfuscated PowerShell, and follow-on payloads such as **Lumma Stealer**, **DarkGate**, **Latrodectus**, **ScreenConnect**, and **AMOS**. Microsoft said the technique has hit thousands of enterprise and consumer devices daily and is now supported by a growing underground market of ClickFix builder kits sold on criminal forums. Fresh activity shows the tactic continuing to evolve. A **SmartApeSG** campaign observed on compromised web traffic redirected victims to a fake human-verification flow that fetched an HTA downloader from `deltaode[.]com`, retrieved a ZIP archive, and abused DLL side-loading to launch an unidentified RAT that later communicated with `89.124.79[.]98` over TCP 443. Separately, Microsoft linked the **CaptiveCrunch** campaign to **Storm-2945**, a sub-cluster of Russia-linked **Midnight Blizzard**, which has manipulated DNS and HTTP traffic on hospitality and other captive-portal networks to redirect travelers to phishing pages and fake browser or OS updates delivering **CornFlake** and **ChocoShell** for credential theft and espionage, including theft of browser credentials, Microsoft 365 tokens, and Wi-Fi credentials.
Aug 1, 2026
Microsoft said the Russian military-linked threat actor **Forest Blizzard** (`APT28`/`Strontium`) has compromised vulnerable home and small-office routers since at least August 2025, changing DNS settings to route traffic through attacker-controlled resolvers. The campaign affected more than **200 organizations** and **5,000 consumer devices** across government, IT, telecommunications, and energy, turning edge devices into covert infrastructure and giving the actor passive visibility into victims’ DNS traffic. For selected high-value targets, the operation escalated into **adversary-in-the-middle** attacks in which spoofed DNS responses redirected users to systems presenting invalid TLS certificates for legitimate services, including **Microsoft Outlook on the web** and government servers. Microsoft said confirmed AiTM activity included non-Microsoft government targets in at least three African countries, while stressing that no Microsoft-owned assets or services were compromised; the company urged defenders to patch and harden routers, replace default credentials, audit DNS settings, and train users not to bypass certificate warnings.
Jul 23, 2026