Midnight Blizzard CaptiveCrunch + UNC6671 Vishing Extortion Wave: OTX Pulse Analysis — Credential & OAuth Attack Detection Pack

Three concurrent OTX pulses confirm that identity — not the endpoint — is now the primary battleground. A Russian nation-state actor is weaponizing hospitality Wi-Fi, while financially motivated crews industrialize voice phishing against SaaS and identity providers. This briefing delivers the detection engineering your SOC needs today.

Threat Summary

Three overlapping campaigns share one objective: harvest Microsoft 365, Okta, and Salesforce session credentials at scale.

1. CaptiveCrunch (UNC2452 / APT29 / Midnight Blizzard / Cozy Bear / Storm-2945) — The most technically sophisticated of the three. Midnight Blizzard is compromising captive portal infrastructure at hotels and conference centers across the United States, India, Saudi Arabia, and the British Indian Ocean Territory. By manipulating DNS and HTTP responses on captive portal networks, the actor redirects victims to lookalike Microsoft infrastructure (m365-owa.com, ms365-device.com, ms365-live.com, owa-ms365.com) to execute three parallel theft paths: classic phishing pages, device code phishing abusing the Microsoft Entra ID OAuth device authorization grant flow, and ClickFix-style social engineering delivering the CornFlake loader and ChocoShell implant. A single CVE reference (CVE-2026-21509) suggests possible exploitation of an authentication-flow weakness as part of the chain.

2. ShinyHunters OAuth Abuse — Between mid-2025 and mid-2026, ShinyHunters-aligned actors targeted Salesforce instances in Retail, Education, and Manufacturing through vishing that impersonated IT support to coerce employees into authorizing malicious OAuth applications, plus supply-chain compromise of trusted integrations (Salesloft, Gainsight). Once an OAuth grant is issued, MFA is irrelevant — the attacker holds a refresh token with legitimate API scope.

3. UNC6671 (BlackFile → Redact / Pink / Helix / Falcon) — Despite the alleged May 2026 retirement of the BlackFile extortion brand, UNC6671 has fragmented across at least four successor fronts and expanded targeting to 16+ industries including Finance, Defense, Aerospace, Healthcare, and Energy. Tradecraft: vishing employees on personal mobile devices, directing them to spoofed SSO/passkey enrollment portals (oktaenroll.com, idokta.com, mypasskeysso.com, setupssopasskey.com) running adversary-in-the-middle (AiTM) phishing kits that defeat traditional MFA — then SaaS data exfiltration and extortion.

The collective signal: vishing + AiTM + OAuth/device-code abuse is the dominant 2026 intrusion pattern, bypassing phishing-resistant perimeter controls by attacking the human and the token rather than the password.

Threat Actor / Malware Profile

UNC2452 / APT29 / Midnight Blizzard (CaptiveCrunch)

• Attribution: Russia SVR-linked. Historically responsible for SolarWinds (SUNBURST), TeamCity exploitation, and prior device-code phishing waves.
• Distribution: Compromised captive portal DNS/HTTP manipulation on hospitality networks; victims on hotel/conference Wi-Fi are transparently redirected to attacker infrastructure.
• Payload behavior:
  • CornFlake — first-stage loader/stealer delivered via ClickFix lures (fake CAPTCHA / "fix your browser" prompts instructing users to paste commands into Run/Terminal). Profiles the host, steals browser credential stores, and stages second payloads.
  • ChocoShell — PowerShell-based reverse shell masquerading as legitimate Chocolatey package-management activity to blend into admin traffic. Provides interactive command execution and file staging.
• C2 communication: HTTPS to M365-typosquat domains (ms365-live.com, owa-ms365.com) at 38.146.28.75; traffic is crafted to resemble legitimate Microsoft service endpoints (login.microsoftonline.com-shaped paths).
• Persistence: Entra ID refresh-token persistence via device code grant (survives password resets); endpoint persistence via scheduled tasks and Run-key entries mimicking update services.
• Anti-analysis: ClickFix payloads execute only after user-initiated paste-and-run, defeating sandbox detonation; ChocoShell checks for analysis tooling and exits on VM artifacts.

ShinyHunters (SaaS OAuth Crew)

• Distribution: Vishing calls impersonating IT support; supply-chain abuse of trusted Salesforce-connected apps.
• Payload behavior: No endpoint malware required. Malicious OAuth consent grants API-level read/write on Salesforce objects; bulk export of CRM data via legitimate REST/Bulk APIs.
• C2: Operator infrastructure at 213.111.148.90 (AS35804, UA-registered "pp sks-lugan") used for vishing prep and exfil staging.
• Persistence: Long-lived OAuth refresh tokens; authorized connected apps survive credential rotation.

UNC6671 (Redact / Pink / Helix / Falcon fronts)

• Distribution: Vishing to personal mobile numbers (bypassing corporate call controls), spoofed Okta/passkey enrollment portals.
• Payload behavior: AiTM phishing kit proxies the real IdP, capturing credentials and session cookies/tokens in real time, defeating TOTP and push MFA. Follow-on SaaS exfiltration (email, file shares, CRM) then double extortion.
• Persistence: Registered attacker-controlled passkeys/authenticators on victim accounts; rogue SSO enrollments.
• Anti-analysis: Domain rotation across a large registrar footprint (79 indicators in pulse); portal pages fingerprint and redirect security scanners to benign sites.

IOC Analysis

The three pulses deliver three distinct operational indicator classes:

Operationalization guidance:

• The UNC6671 Okta-impersonation domains (*okta*, *passkey*, *sso* patterns) are the highest-value DNS blocks — they are pure phishing infrastructure with zero legitimate use. Ingest all 79 into your DNS firewall and Microsoft Sentinel TI feed.
• For device code phishing, static IOCs are secondary to behavioral detection: hunt Entra ID sign-in logs for authenticationProtocol: deviceCode from unexpected geographies/ASNs.
• Tooling: decode and pivot with MISP/OpenCTI for indicator management, VirusTotal/OTX pulses for hash enrichment, urlscan.io for phishing-page forensics, and PassiveTotal/SecurityTrails for registrar-pattern expansion on the UNC6671 domain set.

Detection Engineering

Sigma Rules

---
title: ClickFix Social Engineering - User-Pasted Command Execution
description: Detects ClickFix-style lure execution where a user pastes a command into Run dialog or terminal, spawning encoded PowerShell/mshta from explorer.exe — consistent with CornFlake loader delivery in the CaptiveCrunch campaign.
status: experimental
logsource:
  category: process_creation
  product: windows
author: Security Arsenal Threat Intel
date: 2026/08/13
references:
  - https://www.zscaler.com/blogs/security-research/captivecrunch-midnight-blizzard-weaponizes-hotel-wi-fi-captive-portals
detection:
  selection_parent:
    ParentImage|endswith:
      - '\explorer.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\mshta.exe'
      - '\curl.exe'
  selection_suspicious:
    CommandLine|contains:
      - ' -enc '
      - ' -e '
      - 'FromBase64String'
      - 'IEX'
      - 'Invoke-Expression'
      - 'iwr '
      - 'Invoke-WebRequest'
  condition: selection_parent and selection_child and selection_suspicious
falsepositives:
  - Admin automation launched manually via Run dialog
level: high
tags:
  - attack.execution
  - attack.t1204
  - attack.t1059.001
---
title: Microsoft 365 Device Code Phishing - Entra ID Device Code Flow Anomaly
description: Detects OAuth device authorization grant sign-ins from suspicious networks, matching Midnight Blizzard device code phishing tradecraft against Microsoft Entra ID.
status: experimental
logsource:
  product: azure
  service: signinlogs
author: Security Arsenal Threat Intel
date: 2026/08/13
detection:
  selection_protocol:
    authenticationProtocol|contains: 'deviceCode'
  selection_suspicious_asn:
    networkLocationDetails|contains:
      - 'AS35804'
  selection_ip:
    ipAddress:
      - '38.146.28.75'
  filter_known:
    ipAddress|startswith:
      - '10.'
      - '192.168.'
  condition: selection_protocol and (selection_suspicious_asn or selection_ip) and not filter_known
falsepositives:
  - Legitimate device code flow from managed corporate egress IPs (tune filter to your ASN list)
level: high
tags:
  - attack.initial_access
  - attack.t1566
  - attack.credential_access
  - attack.t1528
---
title: AiTM Phishing Domain Resolution - Okta/M365 SSO Impersonation
description: Detects DNS resolution of UNC6671 Okta/passkey impersonation domains and Midnight Blizzard M365 typosquats from OTX pulse indicators.
status: experimental
logsource:
  category: dns
author: Security Arsenal Threat Intel
date: 2026/08/13
detection:
  selection_ioc:
    query:
      - 'm365-owa.com'
      - 'ms365-device.com'
      - 'ms365-live.com'
      - 'owa-ms365.com'
      - 'oktaenroll.com'
      - 'idokta.com'
      - 'myoktasso.com'
      - 'mypasskeysso.com'
      - 'setupssopasskey.com'
      - 'passkeyms.com'
      - 'keyokta.com'
      - 'portalpasskey.com'
  condition: selection_ioc
falsepositives:
  - Threat researcher sandbox lookups
level: critical
tags:
  - attack.resource_development
  - attack.t1583.001
  - attack.t1557

Microsoft Sentinel KQL Hunt

// Unified hunt: CaptiveCrunch C2 + UNC6671 AiTM domains + ShinyHunters infra + ClickFix process chain
let CaptiveCrunchDomains = dynamic(["m365-owa.com","ms365-device.com","ms365-live.com","owa-ms365.com"]);
let UNC6671Domains = dynamic(["oktaenroll.com","idokta.com","myoktasso.com","mypasskeysso.com","setupssopasskey.com","passkeyms.com","keyokta.com","portalpasskey.com"]);
let SuspiciousIPs = dynamic(["38.146.28.75","213.111.148.90"]);
union isfuzzy=true
(DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteUrl has_any (CaptiveCrunchDomains) or RemoteUrl has_any (UNC6671Domains) or RemoteIP in (SuspiciousIPs)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, ActionType
| extend HuntSource = "NetworkIOC"),
(DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where InitiatingProcessFileName =~ "explorer.exe"
| where FileName in~ ("powershell.exe","pwsh.exe","mshta.exe","curl.exe")
| where ProcessCommandLine has_any ("-enc","FromBase64String","Invoke-Expression","IEX","Invoke-WebRequest","iwr ")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, SHA256
| extend HuntSource = "ClickFixChain"),
(DeviceFileEvents
| where TimeGenerated > ago(30d)
| where SHA256 in ("918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593","be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c")
| project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| extend HuntSource = "MalwareHash")
| sort by TimeGenerated desc

PowerShell Endpoint IOC Hunt

# CaptiveCrunch / UNC6671 endpoint hunt - run via EDR live response or GPO startup
# Checks: malware hashes, ClickFix persistence artifacts, suspicious network state
$ErrorActionPreference = 'SilentlyContinue'
$report = @()

# 1. Known CornFlake/ChocoShell SHA256 sweep of common staging paths
$malHashes = @(
  '918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593',
  'be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c'
)
$searchPaths = @("$env:TEMP","$env:LOCALAPPDATA\Temp","$env:APPDATA","$env:PUBLIC\Documents")
foreach ($p in $searchPaths) {
  Get-ChildItem $p -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
    $h = (Get-FileHash $_.FullName -Algorithm SHA256).Hash.ToLower()
    if ($malHashes -contains $h) {
      $report += [pscustomobject]@{Finding='MALWARE_HASH'; Path=$_.FullName; Hash=$h}
    }
  }
}

# 2. Run-key persistence impersonating update services (CornFlake pattern)
$runKeys = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
             'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run')
foreach ($k in $runKeys) {
  (Get-ItemProperty $k).PSObject.Properties | Where-Object {
    $_.Value -match 'powershell|mshta|rundll32' -and $_.Value -match '-enc|FromBase64|IEX|http'
  } | ForEach-Object {
    $report += [pscustomobject]@{Finding='SUSPICIOUS_RUNKEY'; Path="$k\$($_.Name)"; Hash=$_.Value}
  }
}

# 3. Scheduled tasks launching script interpreters from user-writable paths
Get-ScheduledTask | Where-Object {
  $_.Actions.Execute -match 'powershell|wscript|mshta' -and
  $_.Actions.Arguments -match 'Temp|AppData|-enc|IEX'
} | ForEach-Object {
  $report += [pscustomobject]@{Finding='SUSPICIOUS_TASK'; Path=$_.TaskName; Hash="$($_.Actions.Execute) $($_.Actions.Arguments)"}
}

# 4. Active connections to pulse C2 IPs
Get-NetTCPConnection -State Established | Where-Object {
  $_.RemoteAddress -in @('38.146.28.75','213.111.148.90')
} | ForEach-Object {
  $proc = (Get-Process -Id $_.OwningProcess).ProcessName
  $report += [pscustomobject]@{Finding='C2_CONNECTION'; Path=$proc; Hash="$($_.RemoteAddress):$($_.RemotePort)"}
}

# 5. DNS cache check for AiTM/typosquat domains
Get-DnsClientCache | Where-Object {
  $_.Entry -match 'm365-owa|ms365-device|ms365-live|owa-ms365|oktaenroll|idokta|myoktasso|mypasskeysso|setupssopasskey|passkeyms|keyokta|portalpasskey'
} | ForEach-Object {
  $report += [pscustomobject]@{Finding='PHISH_DNS_CACHE'; Path=$_.Entry; Hash=$_.Data}
}

if ($report) { $report | Format-Table -AutoSize; $report | Export-Csv "$env:TEMP\captivcrunch_hunt.csv" -NoTypeInformation }
else { Write-Host '[+] No CaptiveCrunch/UNC6671 artifacts found.' }

Response Priorities

Immediate (0–4 hours)

• Block all 87 phishing domains from the UNC6671 and CaptiveCrunch pulses at the DNS resolver, secure web gateway, and EDR network layer. Block egress to 38.146.28.75 and 213.111.148.90.
• Deploy the Sigma and KQL detections above; run the 30-day retro-hunt for ClickFix process chains and AiTM domain resolution.
• Sweep endpoints with the PowerShell hunt script for CornFlake/ChocoShell hashes and persistence artifacts.
• Push both SHA256 hashes to EDR blocklists.

Within 24 Hours

• Identity verification surge: Audit Entra ID sign-in logs for deviceCode authentication protocol events and consent grants issued in the last 90 days. Revoke anomalous OAuth grants and refresh tokens — these survive password resets.
• Salesforce connected-app audit: enumerate all authorized OAuth applications; revoke any not explicitly business-approved (ShinyHunters pattern).
• Passkey/authenticator audit on Okta accounts: identify authenticators or passkeys enrolled in the last 60 days that users cannot confirm (UNC6671 persistence).
• Force password resets plus session revocation for any user who resolved a pulse domain or authenticated via device code from a hospitality network.
• Brief executives and frequent travelers: hotel/conference Wi-Fi is actively hostile; mandate hotspot or full-tunnel VPN use.

Within 1 Week

• Phishing-resistant MFA everywhere: FIDO2/passkeys with number-matching — but pair with helpdesk verification hardening, since UNC6671 specifically targets passkey enrollment flows.
• Helpdesk anti-vishing controls: out-of-band verification (callback to directory-listed number, manager approval) before any credential reset, MFA change, or OAuth app authorization. Never action requests initiated by inbound call.
• OAuth governance: disable user consent for third-party apps in Entra ID; require admin consent workflow. Alert on new connected-app authorizations in Salesforce.
• Conditional Access hardening: require compliant-device + token-binding policies for M365/Okta access; block authentication from unmanaged devices and anonymizing/hospitality network ranges where feasible.
• Patch verification for CVE-2026-21509 across affected authentication components.
• Travel security policy: prohibit M365/SSO sign-in on captive portal networks; issue corporate hotspots to traveling staff.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub