Storm-2945 is a sub-cluster of Midnight Blizzard conducting targeted traffic manipulation attacks on hospitality sector networks served by captive portals, leveraging doppelganger domains for AitM phishing and malware delivery. Their operations include AI-augmented device code and OAuth code phishing campaigns leading to Entra device registration and data collection from Microsoft 365. The primary malware used is CornFlake, a Windows RAT that features customizable capabilities for data collection and evasion. Storm-2945 also utilizes the FruitStone web-based C2 panel to manage their campaign infrastructure and compromised endpoints.