Midnight Blizzard CaptiveCrunch, LegionLoader ClickFix & Passkey AiTM Campaigns: OTX Pulse Analysis — Identity Theft Detection Pack

---
title: ClickFix Social Engineering - Suspicious PowerShell Paste Execution
id: 8f3c1a2e-9d4b-4e7a-a1c5-6b2d8f0e3a91
status: experimental
description: Detects ClickFix-style execution where users are lured into running PowerShell commands fetching remote payloads, as seen in LegionLoader and CaptiveCrunch CornFlake delivery.
author: Security Arsenal Threat Intel
references:
    - https://asec.ahnlab.com/en/95374/
    - https://www.zscaler.com/blogs/security-research/captivecrunch-midnight-blizzard-weaponizes-hotel-wi-fi-captive-portals
date: 2026/09/11
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\mshta.exe'
    selection_cli:
        CommandLine|contains:
            - 'Invoke-Expression'
            - 'IEX'
            - 'DownloadString'
            - 'Invoke-WebRequest'
            - 'curl '
            - ' -enc '
            - ' -ec '
            - 'mshta http'
    condition: selection_img and selection_cli
falsepositives:
    - Legitimate admin automation scripts
    - Software deployment tooling
level: high
tags:
    - attack.execution
    - attack.t1059.001
    - attack.t1059.005
    - attack.t1204.002
---
title: Authentication to M365 Lookalike or Passkey Phishing Infrastructure
id: 2d7e4b1c-5a8f-4c3d-9e6a-1f0b7d3c5e82
status: experimental
description: Detects DNS or network connections to known CaptiveCrunch (UNC2452) and passkey AiTM phishing domains used for Microsoft 365 credential theft.
author: Security Arsenal Threat Intel
references:
    - https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/
date: 2026/09/11
logsource:
    category: dns
    product: windows
detection:
    selection:
        query|contains:
            - 'm365-owa.com'
            - 'ms365-device.com'
            - 'ms365-live.com'
            - 'owa-ms365.com'
            - 'setupmypasskey.com'
            - 'validationsetupac.com'
            - 'portalsetuphub.com'
            - 'myconnectkey.com'
            - 'oskeysync.com'
            - 'keysyncos.com'
            - 'oskeyregister.com'
            - 'passkeyhelpdesk.com'
            - 'dallasbackstage.com'
            - 'gemscocl.com'
    condition: selection
falsepositives:
    - Threat research activity
level: critical
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.t1557
    - attack.t1566.002
---
title: JavaScript Loader Fetched from Bare IPv4 CDN Path
id: 4a1b9c7d-2e5f-4a6b-8c3d-7e0f1a9b2c46
status: experimental
description: Detects HTTP requests for JavaScript polyfill/chunk files hosted directly on bare IP addresses, matching CaptiveCrunch loader staging on 213.145.86.112.
author: Security Arsenal Threat Intel
date: 2026/09/11
logsource:
    category: proxy
detection:
    selection_uri:
        cs-uri-path|contains:
            - '/cdn/chunks/polyfill-'
            - '/cdn/chunks/'
    selection_ip:
        c-ip: '213.145.86.112'
    condition: selection_uri and selection_ip
falsepositives:
    - Unlikely; legitimate CDNs use named hosts
level: high
tags:
    - attack.command_and_control
    - attack.t1105
    - attack.t1071.001

// Hunt: CaptiveCrunch / Passkey AiTM / LegionLoader infrastructure and ClickFix execution
let PhishDomains = dynamic(["m365-owa.com","ms365-device.com","ms365-live.com","owa-ms365.com","setupmypasskey.com","validationsetupac.com","portalsetuphub.com","myconnectkey.com","oskeysync.com","keysyncos.com","oskeyregister.com","passkeyhelpdesk.com","dallasbackstage.com","gemscocl.com"]);
let C2IPs = dynamic(["213.145.86.112","162.201.178.68"]);
let NetHits = DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemoteUrl has_any (PhishDomains) or RemoteIP in (C2IPs)
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort, ActionType;
let ClickFixExec = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName in~ ("powershell.exe","pwsh.exe","mshta.exe","rundll32.exe")
| where ProcessCommandLine has_any ("IEX","Invoke-Expression","DownloadString","Invoke-WebRequest"," -enc "," -ec ","mshta http","curl ")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName;
union NetHits, ClickFixExec
| sort by TimeGenerated desc

# Security Arsenal IOC Hunt - CaptiveCrunch / LegionLoader / Casbaneiro host sweep
# Run via EDR live response or PS remoting across fleet
$ErrorActionPreference = 'SilentlyContinue'

$malHashes = @(
    '918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593',
    'be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c',
    '4302586202234cdf1ca058fd3c62be0050c8155ed113f3f62337d756e6915044',
    '0128a4b78aab83796042118ecb3e46e0',
    '27745ec8bde201e771e3f4069e887cad',
    '685b6822b0c66f4f18496eb6ce24f984'
)

Write-Host "[*] Hash sweep: user-writable directories..." -ForegroundColor Cyan
$dirs = @("$env:TEMP", "$env:APPDATA", "$env:LOCALAPPDATA", "$env:USERPROFILE\Downloads", "C:\ProgramData")
foreach ($d in $dirs) {
    Get-ChildItem -Path $d -Recurse -File -Include *.exe,*.dll,*.ps1,*.hta,*.js,*.vbs,*.bat -ErrorAction SilentlyContinue |
    ForEach-Object {
        $h256 = (Get-FileHash $_.FullName -Algorithm SHA256).Hash.ToLower()
        $hMd5 = (Get-FileHash $_.FullName -Algorithm MD5).Hash.ToLower()
        if ($malHashes -contains $h256 -or $malHashes -contains $hMd5) {
            Write-Host "[HIT] Malicious file: $($_.FullName)" -ForegroundColor Red
        }
    }
}

Write-Host "[*] Checking active connections to known C2..." -ForegroundColor Cyan
Get-NetTCPConnection -State Established |
    Where-Object { $_.RemoteAddress -in @('213.145.86.112','162.201.178.68') } |
    ForEach-Object {
        $proc = Get-Process -Id $_.OwningProcess
        Write-Host "[HIT] C2 connection: $($_.RemoteAddress):$($_.RemotePort) by $($proc.ProcessName) (PID $($proc.Id))" -ForegroundColor Red
    }

Write-Host "[*] Checking DNS cache for phishing domains..." -ForegroundColor Cyan
$phish = 'm365-owa|ms365-device|ms365-live|owa-ms365|setupmypasskey|passkeyhelpdesk|keysyncos|oskeyregister|dallasbackstage|gemscocl'
Get-DnsClientCache | Where-Object { $_.Entry -match $phish } |
    ForEach-Object { Write-Host "[HIT] DNS cache: $($_.Entry) -> $($_.Data)" -ForegroundColor Red }

Write-Host "[*] Auditing AutoIt/HTA persistence (Casbaneiro TTP)..." -ForegroundColor Cyan
$runKeys = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
             'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run')
foreach ($k in $runKeys) {
    Get-ItemProperty $k | Get-Member -MemberType NoteProperty | ForEach-Object {
        $val = (Get-ItemProperty $k).$($_.Name)
        if ($val -match 'autoit|mshta|wscript|powershell.*-enc|AppData|Temp') {
            Write-Host "[SUS] Run key: $k :: $($_.Name) = $val" -ForegroundColor Yellow
        }
    }
}
Get-ScheduledTask | Where-Object { $_.Actions.Execute -match 'autoit|mshta|powershell' -and $_.Actions.Arguments -match 'http|AppData|Temp' } |
    ForEach-Object { Write-Host "[SUS] Scheduled task: $($_.TaskName)" -ForegroundColor Yellow }

Write-Host "[*] Hunt complete. Escalate any [HIT] findings to IR immediately." -ForegroundColor Cyan