Cybersecurity researchers have uncovered a sophisticated attack campaign targeting travelers through compromised hotel Wi-Fi networks. According to Microsoft, attackers are hijacking captive portals to deliver CornFlake, a powerful remote access trojan (RAT) capable of stealing sensitive information, recording audio, capturing webcam images, and logging keystrokes.
Microsoft Tracks Campaign as “CaptiveCrunch”
Microsoft has named the operation CaptiveCrunch and attributes it to Storm-2945, an operational sub-cluster linked to the notorious Midnight Blizzard (APT29/Cozy Bear) threat group. The broader APT29 operation has previously been attributed by both the U.S. and U.K. governments to Russia’s Foreign Intelligence Service (SVR).
While Microsoft’s attribution is based on its own intelligence, the company notes that independent public technical confirmation of the CaptiveCrunch campaign is still unavailable.
How the Attack Works
The attackers compromise hotel or hospitality Wi-Fi captive portals—the login pages guests use before accessing the internet.
Once administrative control of the captive portal gateway is obtained, the attackers manipulate the network’s DNS (Domain Name System) responses. Since the compromised gateway also acts as the DNS resolver for connected devices, it can redirect legitimate requests to attacker-controlled websites.
Instead of performing the usual internet connectivity check, victims are redirected to convincing fake browser or operating system update pages.
Importantly, the attack does not automatically infect devices. Victims must still download or execute the malicious file themselves.
ClickFix Technique Tricks Users
Several of the fake update pages use a social engineering technique known as ClickFix.
Victims are instructed to:
- Open Windows Terminal, PowerShell, or Command Prompt
- Copy and paste an attacker-provided command
- Execute the command manually
By convincing users that the action is required to restore internet connectivity or complete an update, attackers bypass many traditional security protections.
Device Code Phishing Added to the Campaign
Microsoft observed another evolution of the campaign beginning on July 16.
Instead of serving malware directly, some compromised captive portals redirect users to Microsoft’s legitimate device code authentication page.
Victims are instructed to enter an attacker-provided authentication code. If completed, the attackers receive a session that has already satisfied multi-factor authentication (MFA), potentially granting access to Microsoft 365 accounts without stealing passwords.
Microsoft recommends organizations disable device code authentication through Conditional Access policies wherever it is not required.
What Makes CornFlake Dangerous?
CornFlake is a malware implant written in the Go programming language.
After execution, it copies itself to:
%APPDATA%\svchost32\svchost32.exe
It then registers itself as a Windows service using the deceptive display name:
Cloud Sync Service
During installation, victims see a fake progress window intended to distract them while the malware installs in the background.
Capabilities of the CornFlake RAT
According to Microsoft’s analysis, CornFlake offers attackers extensive remote control over infected systems.
Its capabilities include:
- Capturing webcam images
- Recording microphone audio
- Logging keystrokes
- Taking screenshots when the device is idle
- Recording clipboard contents along with active window titles
- Stealing browser cookies and saved passwords
- Bypassing Chrome App-Bound Encryption protections
- Scanning removable storage devices
- Launching a remote command shell
The malware also establishes persistence through both Registry Run keys and scheduled tasks. A built-in watchdog mechanism automatically restores these persistence methods if defenders remove them.
ChocoShell PowerShell Stealer Also Identified
Researchers also discovered a second tool called ChocoShell, an in-memory PowerShell-based credential stealer.
Rather than focusing on browser cookies, ChocoShell targets authentication tokens stored by Microsoft services, including:
- Microsoft 365 access tokens
- Azure Active Directory tokens
- Refresh tokens
- Web Account Manager (WAM) tokens
The malware extracts these credentials from Token Broker cache (.tbres) files, allowing attackers to replay authenticated sessions without requiring browser cookies.
Hospitality Networks Across Multiple Countries Affected
Microsoft says it has observed this traffic manipulation since early May across hospitality networks in several countries.
However, the company has not disclosed:
- Which hotels were affected
- Which captive portal providers were involved
- How many users were successfully compromised
Although malware delivery and phishing activity have been confirmed, Microsoft has not released statistics showing how many victims executed the malware or approved the malicious device authentication requests.
Researchers also noted similarities in networking equipment and management systems across the affected locations, suggesting attackers may have compromised shared infrastructure rather than isolated hotel networks.
ReliaQuest’s Findings
Security firm ReliaQuest independently documented the same Microsoft-themed phishing domains and overlapping infrastructure approximately one week before Microsoft’s public report.
The company observed similarities with tactics previously associated with APT28 (Fancy Bear/Forest Blizzard) but stopped short of making a formal attribution, stating that the evidence relied primarily on overlapping tactics, techniques, and procedures (TTPs) rather than direct technical proof.
Microsoft, however, maintains that CaptiveCrunch is operated by Storm-2945.
Initial Entry Point Still Unknown
The method attackers used to gain access to the hotel networks remains under investigation.
ReliaQuest believes—albeit with low-to-medium confidence—that exposed management interfaces combined with weak or reused administrator credentials may have enabled the compromise.
Due to limited visibility into the affected environments, investigators have not yet confirmed the exact intrusion method.
How Travelers Can Protect Themselves
Security researchers recommend that travelers take extra precautions when using hotel or public Wi-Fi.
Some best practices include:
- Use an always-on, full-tunnel VPN to encrypt all internet traffic.
- Avoid downloading browser, operating system, or security updates from captive portals.
- Never install certificates or troubleshooting tools offered by public Wi-Fi login pages.
- Verify software updates through official vendor websites or built-in operating system update services.
- Be cautious of any login page asking you to run commands in PowerShell, Terminal, or Command Prompt.
Final Thoughts
The CaptiveCrunch campaign highlights how attackers continue to exploit trusted infrastructure instead of targeting endpoints directly. By compromising hotel Wi-Fi captive portals, threat actors can manipulate internet traffic, deliver convincing fake updates, and even abuse Microsoft’s legitimate authentication systems.
While Microsoft has not disclosed the full scope of the campaign, the operation demonstrates that public Wi-Fi remains a valuable target for advanced threat actors. Organizations and travelers alike should treat captive portal update prompts with skepticism and rely on secure, encrypted connections whenever possible.
