ChocoShell is a PowerShell credential stealer associated with the CaptiveCrunch campaign. Its code targets browser credentials, session cookies, Microsoft TokenBroker artifacts, and saved Wi-Fi passwords. It also implements mechanisms for bypassing browser encryption protections, evading security controls, and retrieving additional payloads.

Our analysis identified a flaw in ChocoShell’s administrator detection. When executed under a split-token local administrator account, the malware failed to recognize the Administrators SID marked as deny-only. Consequently, it triggered a visible UAC prompt instead of selecting its silent privilege-elevation mechanisms.

Dynamic testing confirmed successful elevation from Medium to High integrity and execution of the encoded PowerShell stub. However, subsequent payload retrieval and credential collection were not observed in the isolated environment.

The report examines ChocoShell’s execution architecture, credential-theft capabilities, command-and-control mechanisms, MITRE ATT&CK mapping, and practical detection opportunities based on source analysis and laboratory telemetry.