Executive summary
Microsoft's investigation published on 31 July 2026 attributes CaptiveCrunch, a campaign manipulating traffic on hospitality networks, to Storm-2945, which it assesses is an operational sub-cluster of Midnight Blizzard. The company reports activity since early May 2026 that redirects users through attacker infrastructure and can lead to fake-update malware delivery or device-code phishing. The initial compromise route into the captive-portal networks remains under investigation. We assess it is likely (B2) that effective response must examine both the traveller's endpoint and cloud identity, because Microsoft's observed chain includes persistent malware, session-token theft and authentication flows that authorise an attacker-controlled session.
Context: the network becomes the lure
Microsoft's original investigation describes manipulation of Domain Name System (DNS) and web traffic on networks served by captive portals. These are the access pages encountered when joining guest networks. Microsoft reports affected hospitality-related networks in several countries and notes common equipment and management systems across some of them.
Those commonalities suggest possible access through shared services, according to Microsoft, but the investigation had not established the initial compromise vector. We therefore do not describe a confirmed supplier breach or one universal appliance vulnerability. The defensible finding is the observed traffic manipulation and its consequences for users joining those networks.
ReliaQuest's report of 23 July 2026 independently describes compromised hospitality gateways and corporate travellers encountering redirected authentication. It discusses similarities with earlier APT28-related tradecraft while explicitly declining direct attribution of this campaign to APT28. Microsoft's later Storm-2945 attribution is its own assessment, based on technical and operational overlaps; similarity of technique should not collapse the two actor labels.
Technical analysis
Redirection precedes the endpoint or account compromise
Microsoft reports that attacker-controlled responses to automated connectivity checks can present apparent browser or operating-system updates. The campaign uses ClickFix-style instructions to persuade users to download and execute malware. The network manipulation can occur before a conventional phishing email or link is involved, but the reported malware-delivery path still relies on the user's execution of the offered content.
That distinction matters for incident interviews. We recommend asking what appeared immediately after network connection, what was downloaded and whether the user followed an update or verification prompt. Asking only whether a suspicious email was opened would miss the entry sequence described here.
ReliaQuest also observed DNS-response forgery and attempted Web Proxy Auto-Discovery (WPAD) abuse. It could not confirm successful WPAD exploitation in the cases described. Its report therefore supports investigating unexpected proxy configuration as a lead, without assuming that every affected device sent all application traffic through an attacker proxy.
CornFlake provides persistent access
Microsoft describes CornFlake as a Windows remote access trojan (RAT) written in Go. On initial execution it can display a fake progress window while copying itself to %APPDATA%\svchost32\svchost32.exe. It registers a service named svchost32, with the display name Cloud Sync Service, and uses additional persistence mechanisms including Registry Run keys and scheduled tasks.
The report also describes a watchdog routine that restores removed persistence. For investigators, finding one service is therefore a starting point, not a complete removal checklist. We recommend preserving the executable, related configuration and all observed persistence locations before recovery, then validating the rebuilt or remediated host against the complete local finding.
CornFlake's collection capabilities include files, keystrokes, browser credentials, screenshots, audio and video. Microsoft says modules are controlled through configuration flags and can be activated selectively. A capability list is not proof that every infected traveller was recorded or that every category of information was collected. Scope those consequences from configuration, execution and transfer evidence where available.
ChocoShell targets credentials and cloud sessions
Microsoft describes ChocoShell as a PowerShell-based information stealer executed in memory. Its collection targets include browser cookies and saved passwords, Microsoft 365 single sign-on (SSO) tokens and wireless-network credentials. Some of its more impactful operations require elevated permissions; the report describes different collection paths and cleanup after exfiltration.
The operational implication is that endpoint and identity findings can diverge. A malware file may be removed while a stolen session or credential still requires investigation. Our recommendation is to correlate the endpoint timeline with cloud sign-ins, token-related activity and subsequent access to sensitive resources, rather than using the absence of a current file as an account-recovery decision.
Microsoft describes CornFlake as a longer-lived foothold and ChocoShell as focused on high-value credential extraction. These roles support examining both persistence and collection. They do not establish that both tools ran on every affected system.
Device-code phishing can use a real sign-in page
Microsoft says it observed CaptiveCrunch landing pages redirecting users into device-code authentication experiences from 16 July 2026. In this flow, an attacker initiates an authentication request and persuades the user to enter the supplied code on a legitimate Microsoft page. If successful, the user authorises the attacker's session.
ReliaQuest directly observed device-code abuse on ms365-live[.]com in a limited number of cases. Its report explains that a successful approval can issue valid tokens to the attacker-controlled client without harvesting a password on a fake page. A familiar sign-in domain or completed multifactor authentication (MFA) challenge therefore does not, by itself, establish that the user intended to authorise that client.
Impact and attribution boundaries
Microsoft assesses Storm-2945 as a sub-cluster of Midnight Blizzard, citing technical and operational similarities to other activity in that broader cluster. Its account connects the campaign to targeted intelligence collection, while the immediate defensive evidence concerns particular network sessions, downloads, implants and cloud authorisations.
We recommend preserving that distinction in incident reporting. A device connected to an affected venue is exposed to investigation; it is not automatically a confirmed malware victim. Likewise, a suspicious device-code prompt is not a successful token grant unless the authentication and subsequent activity support that finding.
The public evidence also leaves the initial gateway compromise unresolved. Investigation of a traveller's device can proceed without guessing that missing step. For a venue operator, determining administrative access and configuration changes remains a separate task requiring evidence from the network equipment and its management services.
Indicators and detection opportunities
Microsoft's original report supplies domains, addresses, hashes and hunting examples. The examples below are a bounded selection; they should be correlated with dates and the affected user or device.
| Indicator or behaviour | Investigation focus | Qualification |
|---|---|---|
ms365-device[.]com or ms365-live[.]com |
Redirects and device-code authentication activity | Microsoft lists first observations on 23 July 2026 and 14 May 2026 respectively |
m365-owa[.]com or owa-ms365[.]com |
Connections to the reported interception infrastructure | Microsoft lists first observations on 20 July 2026 and 16 July 2026 respectively |
%APPDATA%\svchost32\svchost32.exe |
CornFlake file presence and execution | Preserve parent process, account and related persistence |
Service svchost32, display name Cloud Sync Service |
The service registration described by Microsoft | A generic cloud-themed name alone is insufficient |
213.145.86[.]112 |
ChocoShell command-and-control connections | Microsoft lists first observation on 1 July 2026 |
Microsoft also proposes hunting for file creation within two minutes of a network connectivity test and explicitly warns that matching files may be benign or unrelated. We recommend retaining that qualification in alert handling. Correlate the download with its process tree, destination, user actions and subsequent execution instead of treating timing alone as confirmation.
Immediate response
First, move the affected user to a trusted connection and preserve the relevant network, browser and endpoint timeline. Record the venue, connection time, unexpected prompts, downloads and any code entered into an authentication page. These are our response recommendations based on the two delivery branches described by Microsoft.
Second, investigate execution and persistence where malware is suspected. Examine CornFlake's service, file and additional persistence alongside PowerShell activity and credential-access alerts. If compromise is established, contain and recover the device through the organisation's incident process. Account for the watchdog behaviour before accepting removal of one artefact as sufficient.
Third, investigate cloud access even where endpoint malware is not found. Review device-code authentication, suspicious sign-ins, new device registrations and subsequent resource access. Microsoft describes earlier Storm-2945 operations involving device registration and Microsoft 365 data collection, making those sensible scoping questions rather than proof that they occurred in every CaptiveCrunch case.
Fourth, contain confirmed identity exposure. We recommend revoking affected sessions and credentials as supported by the investigation, checking for unauthorised registrations and verifying access from a trusted device. Coordinate endpoint and identity recovery so a compromised device does not receive replacement credentials while its persistence remains unresolved.
ATT&CK context
Our mapping of traffic manipulation is Adversary-in-the-Middle, T1557. The documented theft of cloud access tokens is consistent with Steal Application Access Token, T1528. These mappings describe different points in the observed chain and do not imply that a particular user experienced both.
For coverage, the first requires network and browser context; the second requires identity and session evidence. A single endpoint alert cannot necessarily resolve the full account-access question, and a cloud sign-in record alone cannot identify the network device that caused a redirection.
Mitigation for travel and guest networks
Microsoft recommends private connectivity where practical, including managed hotspots, and cautions against software updates, certificates or troubleshooting tools offered through captive portals. Update requests should be verified through trusted operating-system mechanisms. It also recommends reducing unnecessary disclosure of corporate credentials and travel-related identity information during guest-network registration.
ReliaQuest recommends always-on, full-tunnel virtual private network (VPN) coverage that includes DNS and prevents ordinary internet access before the tunnel is active. That implementation condition matters: a configured VPN is not equivalent to verified protection of traffic before establishment. Our recommendation is to test the actual guest-network onboarding sequence, including exceptions and failure behaviour.
For identity, Microsoft recommends blocking device-code flow wherever possible and restricting it through Conditional Access where required. It also recommends passkeys, MFA and identity-driven access controls. Assess genuine device-code requirements before granting exceptions, then monitor those authorised uses. The control should address who and what is being authorised, not merely whether a real sign-in page appeared.
Outlook
Microsoft's 31 July 2026 account brings the hospitality-network manipulation, malware delivery and device-code activity into one attributed investigation. It leaves important uncertainties explicit, particularly initial access to the captive-portal ecosystem and the scope of shared-service involvement.
Our likely (B2) judgement is that combined endpoint and cloud-identity response is necessary where the described compromise is evidenced. The basis is the separation between persistent implants, stolen sessions and user-authorised attacker tokens. Closure should depend on resolving the observed branches in the organisation's own evidence, not simply removing a download or changing one password.
