The campaign, dubbed CaptiveCrunch, is attributed to the Russian threat actor Midnight Blizzard (APT29), specifically a sub-cluster tracked as Storm-2945. Active since at least early May 2026 (with device and OAuth code phishing operations since February), attackers manipulate DNS and HTTP traffic on captive portal equipment used in hotel and conference center Wi-Fi networks. After modifying DNS settings, victims are redirected to: (1) phishing pages impersonating Microsoft 365 login portals, (2) device code phishing pages abusing Microsoft Entra ID authentication flows, or (3) fake browser/OS update pages delivering malware via ClickFix prompts. There is also evidence of Android APK delivery targeting. Two custom malware families were identified: CornFlake - a Go-based RAT with capabilities including remote shell access, keylogging, clipboard monitoring, screenshot capture, microphone/webcam surveillance, browser credential and cookie theft, Microsoft 365 session token theft, file exfiltration, USB monitoring, and system reconnaissance. It persists via Windows service registrations, registry run keys, named tasks, and a watchdog routine, disguising itself as 'Cloud Sync Service'. It displays fake progress windows mimicking Windows update, Defender virus scan, disk optimization, network diagnostics, browser update, or document viewer installer screens. ChocoShell - an in-memory PowerShell credential stealer targeting browser cookies, saved passwords, Microsoft 365 and Azure AD tokens, and Wi-Fi credentials. A web-based management panel named FruitStone was also discovered, used to manage infected systems, browse files, execute PowerShell commands, and capture screenshots and keystrokes. AI tools were assessed as likely used in malware development based on extensive code comments.