CaptiveCrunch: Midnight Blizzard Hospitality Network AiTM Campaign (Campaign)

Microsoft Threat Intelligence identified "CaptiveCrunch," an ongoing nation-state cyberespionage campaign by Storm-2945/Midnight Blizzard that compromises hospitality captive-portal infrastructure to perform adversary-in-the-middle attacks against travelers, redirecting DNS/HTTP traffic to malicious infrastructure to deliver malware or phishing (including Microsoft Entra device code prompts) to hijack Microsoft 365 sessions; operators deploy CornFlake RAT and ChocoShell PowerShell infostealer to persist, steal credentials and tokens, exfiltrate sensitive data (browser credentials, SSO/Azure AD tokens, Wi‑Fi credentials, documents, media, keystrokes) and leverage AI for development and operations.