CaptiveCrunch Campaign Delivers Malware and Steals Traveler Credentials

Midnight Blizzard, specifically the Storm-2945 sub-cluster, is conducting the CaptiveCrunch campaign against travelers through compromised captive portals in the hospitality sector. The attackers manipulate DNS and HTTP traffic to redirect victims to phishing infrastructure or deliver malware, including the CornFlake RAT and ChocoShell infostealer. The campaign combines AI-augmented operations with adversary-in-the-middle techniques to steal credentials and active session tokens.

Microsoft Threat Intelligence linked Storm-2945 to Midnight Blizzard based on technical similarities involving device code phishing and shared victimology. The investigation uncovered doppelganger domains impersonating Microsoft services and the deployment of Golang-based RATs. Researchers also observed ClickFix techniques designed to trick users into manually executing malicious code on their devices.

Organizations should avoid placing trust in hospitality and guest Wi-Fi networks and use private connectivity, such as mobile hotspots, whenever possible. Deploying phishing-resistant MFA methods, including passkeys, and enforcing conditional access policies that restrict device code flows is strongly recommended. Users should also be trained to recognize ClickFix-style prompts and avoid installing software offered through captive portals.

If CaptiveCrunch activity is detected, organizations should investigate suspicious scheduled tasks, service registrations, and unauthorized OAuth device code authentications. Security teams should monitor for anomalous PowerShell behavior, particularly AMSI tampering and UAC bypass attempts. Microsoft Entra ID Risky Sign-in reports should also be reviewed for evidence of session hijacking.

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

Attack Narrative & Commands: The adversary seeks to establish a command-and-control (C2) channel using the ChocoShell infostealer. To evade traditional network monitoring, the malware is configured to communicate via HTTP requests that mimic legitimate tracking pixels. The attacker will initiate two distinct connection attempts: first, a connection to the hardcoded C2 IP 213.145.86.112 , and second, a request containing the specific masqueraded URL path /t/pixel.gif?m= . These actions are designed to trigger the specific selection1 and selection2 logic within the detection rule.

Regression Test Script:

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.