Midnight Blizzard-Linked Campaign Abuses Hotel Wi-Fi Portals to Steal Microsoft 365 Credentials
Summary
Microsoft attributes CaptiveCrunch to Storm-2945, a Midnight Blizzard sub-cluster. The campaign manipulates hospitality Wi-Fi captive portals to redirect victims to Microsoft 365 credential theft, device-code phishing, and malware; it has also expanded to Android.
Key points
- Microsoft reported the ongoing CaptiveCrunch campaign on July 31 and attributed it to Storm-2945, a sub-cluster of Midnight Blizzard, also known as APT29.
- The activity manipulates DNS and HTTP traffic on hotel, conference-center, and similar captive portal networks to redirect users to attacker-controlled infrastructure.
- Evidence suggests shared captive portal services were compromised, rather than each targeted venue being breached individually; compromised gateways were identified in several U.S. cities, India, and Saudi Arabia.
- The campaign uses Microsoft 365 credential harvesting, adversary-in-the-middle phishing, and device-code phishing, and delivers CornFlake and ChocoShell malware.
- Microsoft assesses that Storm-2945 used AI tools in parts of its operations, including malware development; the article cites unusually detailed malware code comments as part of the basis for that assessment.
- The campaign has expanded to Android targeting through malicious APK files. The article lists related domains, IP addresses, malware hashes, and ChocoShell command-and-control URLs.
- The article recommends eliminating implicit trust in network paths and enforcing phishing-resistant authentication.
Article Details
- Event Type
- Credential theft and malware campaign using compromised captive portal services to redirect victims to attacker-controlled infrastructure.
- Impact
- The campaign harvests Microsoft 365 credentials, conducts device code phishing, delivers malware, and has expanded to Android devices. The article reports compromised gateways in several U.S. cities, India, and Saudi Arabia; the extent of resulting account compromise is not stated.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | m365-owa[.]com | CaptiveCrunch adversary-in-the-middle infrastructure. |
| DOMAIN | ms365-device[.]com | CaptiveCrunch device code flow redirect domain. |
| DOMAIN | ms365-live[.]com | CaptiveCrunch device code flow redirect domain. |
| DOMAIN | owa-ms365[.]com | CaptiveCrunch adversary-in-the-middle infrastructure. |
| IPV4 | 104[.]194[.]159[.]150 | CaptiveCrunch adversary-in-the-middle infrastructure. |
| IPV4 | 107[.]189[.]26[.]194 | ChocoShell C2 and CaptiveCrunch DNS resolver. |
| IPV4 | 213[.]145[.]86[.]112 | ChocoShell C2 server. |
| IPV4 | 31[.]57[.]243[.]154 | CaptiveCrunch adversary-in-the-middle infrastructure. |
| IPV4 | 38[.]146[.]28[.]132 | CaptiveCrunch DNS resolver. |
| IPV4 | 38[.]146[.]28[.]75 | CaptiveCrunch adversary-in-the-middle infrastructure. |
| SHA256 | 918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593 | CornFlake file hash. |
| SHA256 | be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c | ChocoShell file hash. |
Threat Actors
Malware
ChocoShellto support a significant portion of its operations, including the development of the CornFlake and ChocoShell malware. This assessment is based partly on extensive and unusually detailed comments found in theCornFlakeleveraged AI tools to support a significant portion of its operations, including the development of the CornFlake and ChocoShell malware. This assessment is based partly on extensive and unusually detailed comments
Vendors
Products
Androidcontributions from Anthropic and OpenAI to the investigation. CaptiveCrunch has also expanded to target Android devices through malicious APK files.Microsoft 365portal networks at hospitality venues, redirecting victims to attacker-controlled infrastructure for Microsoft 365 credential harvesting, device code phishing, and malware delivery.Zscaler Cloud Sandboxdetects indicators related to this threat at various levels. The figure below depicts the Zscaler Cloud Sandbox, showing detection details for the ChocoShell malware payload.
Countries
Indiabreaching each location individually. ReliaQuest identified compromised gateways in several U.S. cities, India, and Saudi Arabia. Russiaof Midnight Blizzard (also known as APT29, Cozy Bear, NOBELIUM, and BlueBravo), a threat group linked to Russia. The campaign manipulates DNS and HTTP traffic on captive portal networks at hospitality venues,Saudi Arabialocation individually. ReliaQuest identified compromised gateways in several U.S. cities, India, and Saudi Arabia. United States