Midnight Blizzard launches CaptiveCrunch
ID: 6ae870dd-6541-5964-b97b-7938d28ad0cc
STIX ID: report--6ae870dd-6541-5964-b97b-7938d28ad0cc
Feed Name: Zscaler Security Research Blog
Threat Score
ChocoShell is an in-memory PowerShell infostealer that disables AMSI via .NET reflection, detects sandboxes/VMs, escalates privileges using multiple silent UAC bypasses (with fallbacks), and harvests browser cookies/passwords, Microsoft 365/Azure tokens, and Wi‑Fi credentials; stolen data is compressed, Base64-wrapped, and exfiltrated over HTTPS to C2 endpoints disguised as tracking pixels and polyfill JS files, while operators use an unauthenticated web C2 panel branded CloudSync Console (FruitStone).
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.