CaptiveCrunch (Storm-2945) DNS query for Microsoft-impersonating doppelganger domain served via hijacked hotel Wi-Fi

Duo Tech@duotech

•updated Aug 6, 2026•0•0•7

Detects DNS queries for Storm-2945 Microsoft-impersonating doppelganger domains and traffic to actor-controlled AitM resolver/redirect infrastructure on captive-portal networks.