Custom Malware Breached Microsoft 365 Accounts

Overview

Microsoft has attributed a global campaign targeting hospitality Wi‑Fi networks to the Russian threat actor Midnight Blizzard (APT29), also tracked as Storm‑2945. The campaign, dubbed CaptiveCrunch, manipulates captive portal equipment to intercept traffic, redirect victims to phishing pages, and deliver custom malware families — CornFlake and ChocoShell — designed to steal credentials and maintain persistent access.

Attack Chain

• DNS manipulation: Attackers alter DNS and HTTP traffic on hotel and conference Wi‑Fi networks.
• Phishing routes: Redirect victims to fake Microsoft 365 login portals or device code phishing pages abusing Microsoft Entra ID flows.
• Malware delivery: Fake browser/OS update pages push malware via ClickFix prompts.
• Android targeting: Some landings deliver malicious APK files to mobile devices.

CornFlake Malware

A Go‑based remote access trojan (RAT) with extensive surveillance and theft capabilities:

• Remote shell access
• Keylogging and clipboard monitoring
• Screenshot capture
• Microphone and webcam surveillance
• Browser credential and cookie theft
• Microsoft 365 session token theft
• File exfiltration and USB monitoring

CornFlake disguises itself as “Cloud Sync Service”, showing fake progress windows (e.g., Windows update, Defender scan) while copying itself to %AppData% for persistence. It registers services, run keys, tasks, and watchdog routines to survive removal attempts.

ChocoShell Malware

An in‑memory PowerShell credential stealer targeting:

• Browser cookies and saved passwords
• Microsoft 365 and Azure AD tokens
• Wi‑Fi credentials

ChocoShell operates stealthily, leaving minimal forensic traces while exfiltrating sensitive authentication data.

Command & Control Infrastructure

Microsoft discovered FruitStone, an unprotected web‑based management panel used by attackers to:

• Browse victim files
• Execute PowerShell commands
• Capture screenshots and keystrokes
• Manage infected systems

Defensive Guidance

Microsoft recommends:

• Treat hotel Wi‑Fi as untrusted — prefer private cellular or managed connections.
• Avoid captive portal updates — do not install software offered via hotel/conference Wi‑Fi prompts.
• Adopt phishing‑resistant MFA and passkeys.
• Disable Entra device code authentication unless required.
• Avoid corporate credentials for guest Wi‑Fi registration.

Expert in the Cloud Insight

CaptiveCrunch highlights how trusted environments like hotel Wi‑Fi can become high‑risk attack surfaces. By combining DNS manipulation, phishing, and custom malware, Midnight Blizzard exploits the weakest link in remote work and travel security. For enterprises, the lesson is clear: assume public Wi‑Fi is hostile, enforce phishing‑resistant authentication, and monitor for stealthy malware families like CornFlake and ChocoShell.