CaptiveCrunch: Midnight Blizzard Weaponizes Hotel Wi-Fi Captive Portals to Steal Microsoft 365 Credentials

Summary

Storm-2945, a sub-cluster of Midnight Blizzard, is conducting a credential theft campaign tracked as CaptiveCrunch. The attackers manipulate DNS and HTTP traffic on compromised captive portal networks at hospitality venues to redirect users to phishing infrastructure. These sites are used to harvest Microsoft 365 credentials, conduct device code phishing, and deliver CornFlake and ChocoShell malware.

Investigation

Microsoft Threat Intelligence and ReliaQuest identified compromised captive portal gateways across several U.S. cities, India, and Saudi Arabia. The investigation revealed AI-assisted malware development involving CornFlake, a Go-based RAT, and ChocoShell, a PowerShell stealer. Evidence indicates the adversary targeted shared captive portal services rather than compromising individual hospitality locations.

Mitigation

Organizations should configure Zscaler Client Connector in full tunnel mode and disable local proxying to reduce the risk of rogue proxy injection. DNS Security and strict outbound DNS filtering should be enabled to prevent queries from reaching poisoned resolvers. SSL inspection and advanced malware protection should also be enforced to detect phishing pages and malicious payloads.

Response

If CaptiveCrunch activity is detected, affected devices should be isolated and Microsoft 365 session tokens and OAuth permissions revoked. Network logs should be reviewed for unauthorized DNS or HTTP redirection and recent captive portal connections. Security teams should also hunt for CornFlake persistence mechanisms, including newly created services or scheduled tasks.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary has gained initial access and is attempting to deploy the CornFlake RAT for persistent access and credential harvesting. To avoid detection by basic signature-based tools, they often use specific filenames; however, in this simulation, we are mimicking a “loud” deployment where the malware is invoked directly with its namesake string to validate that the SOC’s primary detection for this threat actor is functioning. We will launch two separate processes: one simulating the CornFlake RAT and one simulating the ChocoShell stealer.

• Regression Test Script:

  # Simulation script to trigger the CornFlake and ChocoShell detection rules.
  # This mimics the command-line arguments used by the malware.
  
  Write-Host "[+] Starting Malware Simulation..." -ForegroundColor Cyan
  
  # Simulate CornFlake RAT execution
  Write-Host "[+] Executing CornFlake simulation..." -ForegroundColor Yellow
  Start-Process "cmd.exe" -ArgumentList "/c echo Simulating CornFlake malware execution" -WindowStyle Hidden
  
  # Simulate ChocoShell Stealer execution
  Write-Host "[+] Executing ChocoShell simulation..." -ForegroundColor Yellow
  Start-Process "powershell.exe" -ArgumentList "-Command `"Write-Output 'Running ChocoShell stealer module';`"" -WindowStyle Hidden
  
  Write-Host "[+] Simulation commands dispatched." -ForegroundColor Green

• Cleanup Commands:

  # No persistent files were created, but we ensure any spawned cmd/powershell instances are closed.
  Stop-Process -Name "cmd" -ErrorAction SilentlyContinue
  Stop-Process -Name "powershell" -ErrorAction SilentlyContinue
  Write-Host "[+] Cleanup complete." -ForegroundColor Cyan