The CaptiveCrunch campaign has been underway since May 2026. The attackers manipulate DNS and web traffic on captive portals used by networks with hotel, airport, conference, or public Wi-Fi connections. These sites display convincing prompts claiming that a browser update, Windows update, network repair tool, security scan, or certificate installation is necessary before internet access can continue.
Security experts suspect corporate travelers are the primary target due to their devices potentially containing access to business email, cloud services, sensitive documents, and virtual private networks. They can mimic a variety of legitimate tools such as Windows Update, Microsoft Defender, DirectX installers, disk optimization utilities, browser updates, PDF viewers and Windows Network Diagnostics.
Then it applies persistence by creating a Windows service named "Cloud Sync Service" and displays it as "Windows Update." It also creates Registry Run keys and scheduled tasks for persistence purposes. Once installed, CornFlake steals files, logs keystrokes, monitors clipboard contents, takes screenshots, records audio, accesses the webcam, scans USB drives and runs commands remotely.
Indicators of Compromise (IoCs) : - Malicious domain: ms365-device[. ]com - Storm-2945 phishing and traffic-manipulation infrastructure - Malicious domain: ms365-live[. ]com - Microsoft service impersonation domain
