Midnight Blizzard CaptiveCrunch, codemado AiTM Phishing Stack, GhostDesk Spyware & WP-SHELLSTORM Webshell Botnet: OTX Pulse Analysis — Credential Theft Detection Pack | Security Arsenal

Threat Summary

Four concurrent OTX pulses published on 2026-08-12 paint a coherent picture of a rapidly industrializing credential-theft ecosystem — one that now spans opportunistic cybercrime all the way up to a Russian state-nexus APT.

The headline: even nation-state operators are borrowing commodity phishing tradecraft. Midnight Blizzard (UNC2452 / APT29 / Cozy Bear) is weaponizing hotel and conference-center Wi-Fi captive portals — manipulating DNS and HTTP responses on hijacked portal networks — to redirect traveling executives and government personnel to lookalike Microsoft 365 login pages, Entra ID device code phishing flows, and ClickFix-style fake CAPTCHA lures that deliver the CornFlake loader and ChocoShell implant. This is not spray-and-pray; it is targeted interception of high-value mobile users at moments of maximum trust ("the hotel Wi-Fi asked me to sign in").

In parallel, a misconfigured Python SimpleHTTPServer on a Budapest VPS accidentally exposed the full operational stack of three independent AiTM (Adversary-in-the-Middle) phishing operators. The most mature, an Egyptian actor tracked as codemado active since 2018, runs a complete phishing-as-a-platform built on Evilginx with a custom tooling layer dubbed MaDoO Blaster, plus AsyncRAT for post-compromise persistence, and abuse of RMM tools for hands-on-keyboard access. A second operator (saroula01) harvested 218 victims across 12 countries purely through OAuth Device Code Flow abuse — no malware required.

The remaining pulses round out the supply side of this ecosystem: GhostDesk, a spyware Chrome extension dropped by a fake CCleaner installer (trojan dropper using CScript multi-stage execution and DuckDNS C2), and WP-SHELLSTORM, a financially motivated access-broker group whose own open directory leaked tooling showing 1.4 million targeted domains, 27 weaponized CVEs, and 5,700+ active webshells (Godzilla, VShell, SNOWLIGHT, BestShell) across WordPress and Joomla. WP-SHELLSTORM is the classic initial-access feeder: harvested site credentials and webshell access get resold to exactly the kind of operators running the AiTM campaigns above.

Collective objective: capture Microsoft 365 / OAuth session material at scale, monetize it directly (finance, retail, tech) or broker it, and maintain durable access via webshells and RAT implants. The common thread across all four pulses is the abuse of legitimate authentication and infrastructure trust — OAuth flows, captive portals, browser extensions, and CMS plugins — rather than noisy exploitation.

Threat Actor / Malware Profile

Midnight Blizzard / UNC2452 (APT29, Cozy Bear, Storm-2945) — CaptiveCrunch

Distribution: Compromise of captive portal infrastructure at hotels, conference centers, and hospitality venues. DNS and HTTP traffic on the portal network is manipulated to inject redirects to attacker-controlled Microsoft 365 lookalikes (e.g., m365-owa.com, ms365-device.com).
Payload behavior: Multi-modal: (1) credential-harvesting phishing pages, (2) Entra ID device code phishing — victim is coached into entering an attacker-generated device code, silently enrolling attacker's token, (3) ClickFix social engineering delivering CornFlake loader which stages ChocoShell, a PowerShell-based implant.
C2: Rotating low-reputation VPS IPs (e.g., 38.146.28.75) fronted by M365-themed typosquat domains; traffic designed to blend with legitimate Microsoft authentication flows.
Persistence: Stolen OAuth refresh tokens and session cookies (token theft survives password resets); ChocoShell persistence via Run keys and scheduled tasks when the implant path is taken.
Anti-analysis: Heavy reliance on living-off-trusted-identity — minimal on-disk artifacts; exploitation of CVE-2026-21509 for initial foothold; victim-conditional page serving to evade sandboxes and scanners.

codemado / MaDoO Blaster (AiTM Phishing Platform)

Distribution: Phishing email lures across finance, government, healthcare, tech, construction, retail in 12+ countries (US, UK, Canada, EU, Brazil, Singapore, Australia).
Payload behavior: Evilginx-based AiTM reverse proxy captures username, password, and session cookie, defeating MFA. MaDoO Blaster is the operator's custom orchestration/mailing tooling. Post-auth, AsyncRAT is deployed for persistent endpoint access, frequently side-loaded through legitimate RMM tools.
C2: AsyncRAT over infrastructure including picis.net and subdomains (cdn.picis.net, hrvetbr.picis.net, hervw.picis.net, hervw2.picis.net) — CDN-themed hostnames to blend with web traffic.
Persistence: AsyncRAT service/scheduled-task persistence; RMM tool installation providing "legitimate" remote access that survives AV scans.
Anti-analysis: VPS-hosted open directories for tooling distribution, session-cookie-based access (no endpoint malware needed for initial monetization), OAuth Device Code Flow abuse (saroula01) leaving almost no forensic trail.

GhostDesk (Chrome Spyware Extension)

Distribution: Fake CCleaner download site (ccleanerwind.top) impersonating the legitimate utility; trojan dropper chain initiated via CScript (multi-stage WSF/JS).
Payload behavior: Modifies Chrome's extension security configuration to force-install a malicious extension performing keylogging, cookie/session theft, and browsing surveillance.
C2: Dynamic DNS — liderongrade.duckdns.org (193.169.240.81) — classic fast-repoint infrastructure.
Persistence: Malicious Chrome extension survives browser restarts; extension force-install registry/policy manipulation.
Anti-analysis: Staged scripting via CScript to bypass simplistic PE-only detection; abuse of a trusted brand to defeat user suspicion.

WP-SHELLSTORM (Access Broker)

Distribution: Mass automated exploitation of WordPress/Joomla across 1.4M domains using 27 CVEs (including CVE-2020-25213 wp-file-manager, CVE-2021-29441, and 2025–2026-era plugin CVEs); parallel targeting of Apache Nacos and XXL-Job.
Payload behavior: Deployment of Godzilla, VShell, SNOWLIGHT, and BestShell webshells — 5,700+ confirmed active — enabling file management, credential harvesting from wp-config.php, and resale of access.
Persistence: Webshells dropped in plugin/theme/upload directories; rogue admin users; modified legitimate PHP files.

IOC Analysis

The indicator set spans five operational types, each requiring different handling:

Domains/hostnames (phishing & C2): m365-owa.com, ms365-device.com, ms365-live.com, owa-ms365.com (Midnight Blizzard M365 typosquats — block at DNS/proxy and alert on any resolution); picis.net and subdomains (codemado AsyncRAT C2 — sinkhole and retro-hunt 90 days of DNS logs); ccleanerwind.top, liderongrade.duckdns.org (GhostDesk — note the DuckDNS dynamic-DNS pattern; consider alerting on duckdns.org resolution from non-sanctioned hosts).
IPv4: 38.146.28.75 (Midnight Blizzard), 193.169.240.81 (GhostDesk C2). Low-reputation VPS space — block at egress, feed to firewall/EDR network indicators.
File hashes (MD5/SHA1/SHA256): AsyncRAT and GhostDesk payloads. Operationalize via EDR custom indicators (Defender, CrowdStrike, SentinelOne block lists). SHA256 is the durable pivot; MD5/SHA1 are useful for retro-hunting in mail gateways and proxy logs.
CVEs: CVE-2026-21509 (Midnight Blizzard initial access), CVE-2020-25213, CVE-2021-29441, CVE-2025-12057, CVE-2026-0740, CVE-2026-1969, CVE-2026-3844, CVE-2026-48907, CVE-2026-6433 (WP-SHELLSTORM weaponization set). Map these against your external attack surface — any internet-facing WordPress/Joomla/Nacos/XXL-Job asset must be patched or virtual-patched at the WAF immediately.

Tooling guidance: ingest OTX pulses via the OTX DirectConnect API or TAXII into your SIEM/TIP (MISP, OpenCTI, Anomali). Use oletools/peframe for dropper triage, CyberChef for ClickFix script deobfuscation, and jq against M365 unified audit logs to hunt device code flow anomalies (operation DeviceCodeFlow from unfamiliar IPs). Webshell hunting on CMS hosts: YARA + file-integrity monitoring on wp-content/uploads.

Detection Engineering

YAML

---
title: Midnight Blizzard CaptiveCrunch - M365 Typosquat and Device Code Phishing Infrastructure Access
description: Detects DNS queries or network connections to Microsoft 365 lookalike domains and known CaptiveCrunch C2 infrastructure used by UNC2452 for AiTM credential theft and device code phishing
author: Security Arsenal Threat Intel
status: experimental
logsource:
  category: dns
  product: windows
detection:
  selection_domains:
    - 'm365-owa.com'
    - 'ms365-device.com'
    - 'ms365-live.com'
    - 'owa-ms365.com'
  selection_ip:
    DestinationIp: '38.146.28.75'
  condition: 1 of selection_*
falsepositives:
  - Threat intel validation scans
level: critical
tags:
  - attack.credential_access
  - attack.t1557
  - attack.t1566
date: 2026/08/12
---
title: codemado AsyncRAT C2 Communication via picis.net Infrastructure
description: Detects network or DNS activity to picis.net and subdomains associated with the codemado AiTM phishing operator's AsyncRAT command and control, including CDN-themed hostname masquerading
author: Security Arsenal Threat Intel
status: experimental
logsource:
  category: network_connection
  product: windows
detection:
  selection_dns:
    DestinationHostname|contains: '.picis.net'
  selection_hash:
    Hashes|contains:
      - '7f30259d72eb7432b2454c07be83365ecfa835188185b35b30d11654aadf86a0'
      - '1a37b674ed29c877890834e9aba616d9'
  condition: 1 of selection_*
falsepositives:
  - Security researcher validation
level: critical
tags:
  - attack.command_and_control
  - attack.t1071
  - attack.t1102
date: 2026/08/12
---
title: GhostDesk Chrome Spyware - CScript Dropper and Malicious Extension Install
description: Detects the GhostDesk infection chain - CScript execution spawning Chrome extension security modification or force-install of malicious extensions, plus connections to fake CCleaner and DuckDNS C2 infrastructure
author: Security Arsenal Threat Intel
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection_cscript:
    Image|endswith:
      - '\cscript.exe'
      - '\wscript.exe'
    CommandLine|contains:
      - 'chrome'
      - 'Extensions'
      - 'Secure Preferences'
  selection_registry:
    CommandLine|contains:
      - 'ExtensionInstallForcelist'
      - 'SOFTWARE\Policies\Google\Chrome'
  condition: 1 of selection_*
falsepositives:
  - Enterprise Chrome extension management via GPO (validate against approved extension IDs)
level: high
tags:
  - attack.persistence
  - attack.t1176
  - attack.t1059.007
date: 2026/08/12

KQL — Microsoft Sentinel / Defender

// CaptiveCrunch + codemado + GhostDesk: hunt AiTM phishing infra, AsyncRAT C2, and device code phishing artifacts
let SuspiciousDomains = dynamic(["m365-owa.com","ms365-device.com","ms365-live.com","owa-ms365.com","picis.net","ccleanerwind.top","liderongrade.duckdns.org"]);
let SuspiciousIPs = dynamic(["38.146.28.75","193.169.240.81"]);
union isfuzzy=true
(DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemoteUrl has_any (SuspiciousDomains) or RemoteIP in (SuspiciousIPs)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, ActionType
| extend HuntSource = "NetworkIOC"),
(DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where (FileName in~ ("cscript.exe","wscript.exe") and ProcessCommandLine has_any ("chrome","Extensions","Secure Preferences","ExtensionInstallForcelist"))
     or (ProcessCommandLine has_any ("ExtensionInstallForcelist"))
     or (SHA256 in ("7f30259d72eb7432b2454c07be83365ecfa835188185b35b30d11654aadf86a0","918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593","be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c","c0b4a4af8a3a8c4b113d7f203fcf480cfac79160102490daf287748634b9ce23","8d921bdd1f5bc8c03209a5dfacfd9ed313497ac2e3f1b4a2000f4c474a464904"))
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, SHA256, InitiatingProcessFileName, AccountName
| extend HuntSource = "ProcessBehavior"),
(DeviceEvents
| where TimeGenerated > ago(14d)
| where ActionType == "DnsQueryResponse"
| extend parsed = parse_json(AdditionalFields)
| where tostring(parsed.QueryName) has_any (SuspiciousDomains)
| project TimeGenerated, DeviceName, QueryName=tostring(parsed.QueryName), ActionType
| extend HuntSource = "DNS")
| sort by TimeGenerated desc

PowerShell

# Security Arsenal - OTX 2026-08-12 IOC Hunt Script
# Hunts GhostDesk Chrome extension persistence, AsyncRAT artifacts, and AiTM C2 network connections
$ErrorActionPreference = 'SilentlyContinue'
$findings = @()

Write-Host "[*] Checking Chrome ExtensionInstallForcelist policies (GhostDesk persistence)..." -ForegroundColor Cyan
$policyPaths = @("HKLM:\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist","HKCU:\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist")
foreach ($p in $policyPaths) {
    if (Test-Path $p) {
        $vals = Get-ItemProperty $p
        $vals.PSObject.Properties | Where-Object { $_.Name -match '^\d+$' } | ForEach-Object {
            $findings += [PSCustomObject]@{Type="ChromeForcedExtension"; Artifact="$p [$($_.Name)] = $($_.Value)"; Severity="HIGH"}
        }
    }
}

Write-Host "[*] Scanning Chrome extension directories for non-store extensions..." -ForegroundColor Cyan
$extDirs = @("$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions","$env:LOCALAPPDATA\Google\Chrome\User Data\Profile *\Extensions")
foreach ($d in $extDirs) {
    Get-ChildItem $d -Directory | ForEach-Object {
        $manifest = Get-ChildItem $_.FullName -Recurse -Filter "manifest.json" | Select-Object -First 1
        if ($manifest) {
            $m = Get-Content $manifest.FullName -Raw | ConvertFrom-Json
            if ($m.permissions -match "debugger|webRequest|cookies" -and $m.name -notmatch "Google|Adobe|Microsoft") {
                $findings += [PSCustomObject]@{Type="SuspiciousExtension"; Artifact="$($_.Name) : $($m.name) - perms: $($m.permissions -join ',')"; Severity="MEDIUM"}
            }
        }
    }
}

Write-Host "[*] Checking active network connections to known C2 (AsyncRAT picis.net / GhostDesk / CaptiveCrunch)..." -ForegroundColor Cyan
$badIPs = @("38.146.28.75","193.169.240.81")
Get-NetTCPConnection -State Established | Where-Object { $badIPs -contains $_.RemoteAddress } | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess
    $findings += [PSCustomObject]@{Type="C2Connection"; Artifact="$($proc.ProcessName) (PID $($_.OwningProcess)) -> $($_.RemoteAddress):$($_.RemotePort)"; Severity="CRITICAL"}
}

Write-Host "[*] Checking DNS cache for phishing/C2 domains..." -ForegroundColor Cyan
$badDomains = @("picis.net","m365-owa.com","ms365-device.com","ms365-live.com","owa-ms365.com","ccleanerwind.top","duckdns.org")
Get-DnsClientCache | Where-Object { $e=$_.Entry; $badDomains | Where-Object { $e -like "*$_*" } } | ForEach-Object {
    $findings += [PSCustomObject]@{Type="DNSCache"; Artifact="$($_.Entry) -> $($_.Data)"; Severity="HIGH"}
}

Write-Host "[*] Hunting AsyncRAT persistence (scheduled tasks + Run keys with suspicious payloads)..." -ForegroundColor Cyan
Get-ScheduledTask | Where-Object { $_.Actions.Execute -match "AppData|Temp|Public" -and $_.TaskName -notmatch "Microsoft|Google|Adobe" } | ForEach-Object {
    $findings += [PSCustomObject]@{Type="ScheduledTask"; Artifact="$($_.TaskName) : $($_.Actions.Execute) $($_.Actions.Arguments)"; Severity="MEDIUM"}
}
@("HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run","HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run") | ForEach-Object {
    Get-ItemProperty $_ | ForEach-Object { $_.PSObject.Properties } | Where-Object { $_.Value -match "AppData|Temp|cscript|wscript|powershell.*-enc" } | ForEach-Object {
        $findings += [PSCustomObject]@{Type="RunKey"; Artifact="$($_.Name) = $($_.Value)"; Severity="HIGH"}
    }
}

Write-Host "`n===== HUNT RESULTS ($($findings.Count) findings) =====" -ForegroundColor Yellow
$findings | Sort-Object Severity | Format-Table -AutoSize | Out-String -Width 300
$findings | Export-Csv -Path ".\otx_hunt_20260812_$(hostname).csv" -NoTypeInformation

Response Priorities

Immediate (0-4 hours):

Block all pulse IOCs at DNS, proxy, and egress firewall: the four Midnight Blizzard M365 typosquats, picis.net + subdomains, ccleanerwind.top, liderongrade.duckdns.org, and IPs 38.146.28.75 / 193.169.240.81. Push file hashes to EDR block lists.
Run the KQL hunt and PowerShell script across the fleet; retro-hunt 90 days of DNS/proxy logs for AiTM infrastructure contact.
Alert on any Entra ID sign-in using Device Code Flow from IPs outside your known egress ranges — this is the single highest-fidelity signal for both Midnight Blizzard and saroula01-style campaigns.

24 hours (credential exposure assumed):

For any user who authenticated via a flagged domain or shows AiTM session anomalies (token replay from impossible-travel IPs, unfamiliar session fingerprints): revoke all refresh tokens and active sessions (password reset alone is insufficient — AiTM steals session cookies), re-register MFA, and review mailbox rules and OAuth app consents for persistence.
Audit newly consented OAuth applications and Enterprise Application service principals created in the last 30 days.
For hosts with GhostDesk indicators: isolate, enumerate all Chrome extensions, capture browser profile forensics, and rotate every credential stored in or accessed via that browser.

1 week (architecture hardening):

Enforce phishing-resistant MFA (FIDO2/passkeys) for all users, prioritizing executives and frequent travelers; enable Entra ID Conditional Access token protection and compliant-network policies to blunt captive-portal interception.
Issue travel guidance: VPN-first posture on hotel/conference Wi-Fi, never authenticate through captive-portal-initiated login flows.
Deploy Chrome enterprise policy: allowlist-only extensions, disable extension installs outside the allowlist.
WAF virtual patching and patching sprint against the WP-SHELLSTORM CVE set for all internet-facing WordPress/Joomla/Nacos/XXL-Job assets; deploy file-integrity monitoring and YARA webshell scans on wp-content/uploads.
Restrict RMM tooling to an approved allowlist and alert on unauthorized RMM installs (codemado AsyncRAT tradecraft).

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub

Midnight Blizzard CaptiveCrunch, codemado AiTM Phishing Stack, GhostDesk Spyware & WP-SHELLSTORM Webshell Botnet: OTX Pulse Analysis — Credential Theft Detection Pack