Executive Summary
Since early May 2026, Microsoft Threat Intelligence has tracked the 'CaptiveCrunch' campaign, attributed to Storm-2945, a sub-cluster of the SVR-linked actor Midnight Blizzard. The campaign primarily targets corporate travelers by compromising captive portal infrastructure in the hospitality sector (hotels and conference centers) to perform DNS hijacking and HTTP traffic manipulation. The threat actor leverages AI-augmented operations to support social engineering and code development.
Technically, the actor utilizes Adversary-in-the-Middle (AitM) techniques to redirect users to 'ClickFix' landing pages or device code phishing prompts. They deploy a sophisticated toolkit including CornFlake (a Go-based RAT), ChocoShell (a PowerShell infostealer), and manage operations via the FruitStone C2 panel. The primary objective is the extraction of browser cookies, M365 session tokens, and sensitive corporate data to enable long-term espionage.
This campaign represents a significant risk to organizations with frequent international travelers. By compromising the network layer that users traditionally trust for internet access, the actor bypasses standard perimeter defenses. Impacted sectors include hospitality, government, and diplomatic entities, requiring immediate strengthening of identity controls and remote access policies.