Russian group Star Blizzard expands phishing campaigns with a new malware delivery RedFlick technique, using scheduled tasks to deliver the CosmicPulse backdoor.
Russian group Star Blizzard expands phishing campaigns with a new malware delivery RedFlick technique, using scheduled tasks to deliver the CosmicPulse backdoor.
Star Blizzard RedFlick phishing hit 100+ groups that back Ukraine, using scheduled tasks to drop the CosmicPulse backdoor after a single click.
Related Posts:
Attackers Exploit Citrix NetScaler Zero-Day CVE-2026-88772 to Plant Hidden Web Shells
Nigeria-Based Fraudsters Hijack .edu Accounts to Run University Job Scams
SVG Phishing Attacks Return in August as Symantec Logs 222,000 Detections
The post Russia’s Star Blizzard Scales Up Phishing With RedFlick to Deliver CosmicPulse Backdoor appeare
Microsoft Threat Intelligence has uncovered CaptiveCrunch, a cyber espionage campaign linked to Storm-2945, a subgroup of Midnight Blizzard, the Russian state-linked threat actor associated with Russia's Foreign Intelligence Service (SVR).
Active since early May 2026, the operation targets business travelers by exploiting hospitality Wi-Fi networks and captive portals in hotels, conference centers, and similar venues. The campaign combines adversary-in-the-middle attacks, phishing, malware
Microsoft Threat Intelligence has uncovered CaptiveCrunch, a cyber espionage campaign linked to Storm-2945, a subgroup of Midnight Blizzard, the Russian state-linked threat actor associated with Russia's Foreign Intelligence Service (SVR). Active since early May 2026, the operation targets business travelers by exploiting hospitality Wi-Fi networks and captive portals in hotels, conference centers, and similar venues. The campaign combines adversary-in-the-middle attacks, phishing, malware deployment, and AI-assisted development to steal credentials and infiltrate enterprise environments.
Storm-2945 Uses Hospitality Networks to Target Travelers
According to Microsoft, Storm-2945 manipulates DNS and HTTP traffic on public Wi-Fi networks using captive portals. By intercepting users before they reach legitimate websites, attackers redirect victims to malicious infrastructure that hosts fake Microsoft sign-in pages or malware downloads.This approach allows the Midnight Blizzard campaign to compromise users without requiring them to intentionally visit suspicious websites. Microsoft believes the attackers may have gained access to shared captive portal infrastructure used across multiple hospitality providers, expanding the scale of the CaptiveCrunch operation beyond isolated venues.
Credential Theft and Malware Deployment
A key objective of CaptiveCrunch is stealing Microsoft Entra ID credentials. Researchers observed Storm-2945 using counterfeit Microsoft login pages and device code phishing to gain unauthorized access to Microsoft 365 accounts. Once authentication succeeds, the attackers register compromised devices and collect cloud data, making corporate travelers especially attractive targets.The campaign also distributes malware disguised as browser or operating system updates through convincing "ClickFix" prompts that encourage users to run scripts or install software. Similar tactics have targeted Android users by prompting them to download malicious APK files.The primary payload is CornFlake, a Windows remote access trojan written in Go that installs itself as a persistent "Cloud Sync Service." It maintains persistence through Windows services, registry keys, and scheduled tasks while enabling attackers to log keystrokes, capture screenshots, monitor clipboard activity, record webcam and microphone data, steal browser credentials, exfiltrate files, monitor USB devices, and execute remote commands through PowerShell or Windows Command Prompt. Communications with command-and-control servers are encrypted to evade analysis.
AI-Assisted Malware and Centralized Control
Supporting CornFlake is ChocoShell, a PowerShell-based infostealer that operates entirely in memory to avoid detection. It extracts browser passwords, Microsoft 365 Single Sign-On tokens, Azure Active Directory authentication tokens, Wi-Fi credentials, and session cookies while bypassing AMSI, User Account Control, and virtual analysis environments. Microsoft researchers noted that ChocoShell's source code contains detailed developer comments, suggesting significant AI-assisted development.The attackers manage infected systems through FruitStone, a web-based command-and-control platform that allows operators to deploy malware, execute remote commands, collect stolen credentials, review screenshots and keystrokes, configure campaigns, and organize compromised devices by geography and operational status.
Microsoft's Defensive Guidance
Microsoft assesses with high confidence that Storm-2945 operates as part of Midnight Blizzard because of overlaps in tooling, phishing techniques, victim selection, and cloud exploitation methods. The Russian state-linked threat actor has previously targeted governments, diplomatic organizations, NGOs, IT providers, and other strategic sectors.To reduce exposure to CaptiveCrunch, Microsoft recommends treating public Wi-Fi as untrusted, enforcing phishing-resistant multi-factor authentication or passkeys, restricting OAuth permissions, monitoring device registrations, and applying Conditional Access policies. Organizations should also educate employees about ClickFix-style social engineering and avoid installing software, certificates, or updates delivered through captive portals. Business travelers are encouraged to use trusted VPNs, mobile hotspots, or enterprise-managed travel routers whenever possible.
Compromised hotel Wi-Fi gateways redirect business travelers to fake Microsoft 365 login pages allowing attackers to steal credentials and authorization tokens.
Compromised hotel Wi-Fi gateways redirect business travelers to fake Microsoft 365 login pages allowing attackers to steal credentials and authorization tokens.
Russian hackers from the TA488 group exploited a Zimbra webmail flaw triggered when emails were opened or previewed, stealing credentials and up to 90 days of messages from victims.
Russian hackers from the TA488 group exploited a Zimbra webmail flaw triggered when emails were opened or previewed, stealing credentials and up to 90 days of messages from victims.
Entrar
