Microsoft says Russian hackers hijacked hotel Wi-Fi portals to spread malware and steal Microsoft 365 tokens from travelers.

Microsoft Threat Intelligence disclosed CaptiveCrunch, a campaign it attributes to Storm-2945, an operational sub-cluster of Midnight Blizzard, the Russian SVR-linked group also known as APT29 and Cozy Bear. Since early May 2026, Storm-2945 has been manipulating DNS and HTTP traffic on captive portal networks at hotels, conference centers, and shared venues worldwide to redirect guests toward malware and credential theft operations. If you connected to hotel Wi-Fi while traveling in the past few months, this report is worth reading carefully.

“Since early May 2026, Microsoft Threat Intelligence has observed Storm-2945 manipulating DNS and HTTP traffic from networks served by captive portals to redirect user traffic through actor-controlled infrastructure.” reads the report published by Microsoft. “To date, Microsoft has identified widespread compromise of Wi-Fi networks at hospitality-related organizations and other networks serviced by captive portal equipment in several countries. ReliaQuest has identified this activity not only at hotels, but also conference centers and other shared venues, and assesses that the goal of this activity is to access the accounts of corporate travelers.”

That last point matters: the shared infrastructure patterns suggest this may not be a series of individual venue compromises but rather access to something shared across portions of the captive portal ecosystem. Microsoft hasn’t named any provider.

The malware delivered through these networks is CornFlake, a full-featured Windows remote access trojan written in Go.

“CornFlake registers as a Windows service named svchost32 with the display name “Cloud Sync Service” and description “Synchronizes files with the cloud storage provider”, deliberately mimicking the legitimate svchost.exe process.” continues the report. “It establishes redundant persistence mechanisms: Windows service registrations, Registry Run keys, named scheduled tasks, and a persistence watchdog routine that runs continuously to restore any persistence mechanism that is removed by defenders or endpoint protection.”

CornFlake establishes an encrypted C2 channel using ECDH P-256 key exchange and supports dynamic reconfiguration without redeployment. Once installed, the RAT can log keystrokes, monitor the clipboard, capture screenshots, audio and webcam feeds, steal browser credentials, exfiltrate files, monitor USB devices, collect detailed system information, and execute remote commands. It also exposes a local HTTP API, allowing companion malware such as ChocoShell to reuse its secure C2 channel for file theft, configuration updates, and connectivity checks.

“For command and control (C2), CornFlake performs an Elliptic Curve Diffie-Hellman (ECDH) P-256 ephemeral key exchange with the C2 server, derives a session key via SHA-256, and communicates over a custom JSON protocol framed within the encrypted channel.” states the report. “This provides an encrypted channel to the C2 server, with each C2 session using a unique ephemeral key, making decryption of captured traffic impossible without the session-specific private key. “

Each C2 session uses a unique ephemeral key, which means captured traffic can’t be decrypted without that session’s private key. The malware also supports a runtime configuration file that lets the attacker reconfigure C2 servers and targeting without redeploying the implant.

CornFlake is delivered via ClickFix-style pages that impersonate Windows Update screens, Google verification pages, DirectX installers, browser update prompts, and disk optimization utilities — whatever looks most plausible for the venue. The victim still has to execute the payload, but the captive portal controls exactly what they see when they try to connect. Microsoft also found indications that Storm-2945 may be targeting Android devices through the same landing pages, which include instructions to download and install an APK.

The second tool, ChocoShell, is a PowerShell infostealer that runs entirely in memory. Its primary target is credentials.

“ChocoShell collects Microsoft 365 and Azure Active Directory (AD) access tokens, refresh tokens, and Web Account Manager (WAM) tokens from .tbres files in the Token Broker cache. Collection of these tokens represents a significant threat to enterprise environments, as threat actors could replay SSO sessions without browser cookies.” states Microsoft. “Additionally, Wi-Fi credentials are harvested via netsh wlan show profile with key=clear.”

ChocoShell also implements three silent UAC bypass techniques with ordered fallback, disables Windows Defender signature updates, and uses Chrome DevTools Protocol to extract browser cookies by launching the browser with a remote debugging port. This technique bypasses Chrome’s App-Bound Encryption entirely.

Since July 16, some CaptiveCrunch landing pages have added device code phishing to the mix, redirecting guests into Microsoft’s legitimate device code authentication flow. The attacker initiates the authentication request and presents the user with a code to enter at Microsoft’s real sign-in page. When the user enters it, they authenticate the attacker’s session instead of their own — an MFA-satisfied session, since the user just completed the factor. Microsoft recommends blocking the device code flow through Conditional Access policies everywhere it isn’t explicitly required.

Researchers also detailed FruitStone, the web-based C2 panel used by Storm-2945 operators to manage the CaptiveCrunch campaign. It provides a centralized interface to control CornFlake implants, deploy payloads, collect stolen data, and manage compromised devices. Disguised as a legitimate “CloudSync Console,” it supports multi-operator access, agent monitoring, remote commands, file theft, credential collection, configuration updates, and campaign infrastructure management.

The practical advice for travelers is blunt: treat hotel, conference, and airport Wi-Fi as hostile. Use a mobile hotspot or cellular data instead wherever possible. Don’t download or execute anything a captive portal presents as an update, certificate, troubleshooting tool, or security utility. Don’t enter corporate credentials on venue registration pages. And if your organization hasn’t already blocked device code flow in Conditional Access, now is a reasonable time to check.

Recently, ReliaQuest’s threat research team also documented attackers compromising the Wi-Fi gateways at hotels and conference centers, then quietly rerouting guests toward fake Microsoft login pages.

There’s a pattern connecting all this to previous campaigns. The tradecraft echoes a Russian-linked operation called FrostArmada, which hit home routers the same way earlier this year, and researchers tie both to the group known as APT28 (aka UAC-0001, aka Fancy Bear, Pawn Storm, Sofacy Group, Sednit, BlueDelta, and STRONTIUM). The link isn’t a smoking gun; it’s shared technique, not shared infrastructure, and the researchers say so plainly.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Hotel Wi-Fi)

Hackers compromised hotel Wi-Fi gateways to redirect users to fake Microsoft 365 login pages and steal credentials.

ReliaQuest’s threat research team just documented attackers compromising the Wi-Fi gateways at hotels and conference centers, then quietly rerouting guests toward fake Microsoft login pages. No phishing email required. No malicious attachment. Just bad luck about which hotel you picked.

“Adversaries have been compromising public Wi-Fi gateways at hotels, conference centers, and other shared venues to hijack the accounts of traveling corporate employees.” reads the report published by ReliaQuest. “Once they control the Wi-Fi gateway, they quietly redirect users to attacker-controlled infrastructure to steal credentials, in activity ongoing since at least June 2026.”

The mechanism is simple once you see it. These gateways handle DNS for every device that connects, so whoever controls the gateway controls where your traffic actually goes, even when the address bar looks completely normal. ReliaQuest found compromised devices across several US cities plus India and Saudi Arabia, hitting employees from finance, law, healthcare, energy, and retail, which tells you this isn’t aimed at one industry. It’s aimed at anyone who travels for work.

Researchers think the entry point was weak or reused admin credentials on internet-facing management interfaces, things like exposed SSH or web consoles.

“ReliaQuest assesses with low-to-medium confidence that initial access into these devices exploited exposed management interfaces (including internet-facing SSH, SNMP, and web administration consoles) in combination with weak or reused administrative credentials.” continues the report. “We encountered visibility constraints into the individual devices that prevented confirmation of this hypothesis, but this methodology would be consistent with the gateway targeting and DNS poisoning patterns documented in recent reporting on an APT28-linked campaign known as “FrostArmada.””

Once inside, the attackers pointed DNS toward domains built to look like Microsoft’s login pages, including m365-owa.com and ms365-live.com. The whole thing runs on trust, since a device joining a network just assumes the DNS resolver it’s handed is telling the truth.

That trust gets abused in a way that dodges the DNS protections people already have. Switching to a hardcoded resolver like 8.8.8.8 doesn’t save you, because the query still leaves the laptop unencrypted and the gateway can rewrite the answer before it ever reaches Google’s server. Encrypted DNS tools help only if they run in strict mode; the default “opportunistic” mode quietly falls back to plaintext the moment encryption fails, and that fallback is exactly what gets hijacked.

“Two configurations do stop it. A full-tunnel VPN routes all DNS through the corporate tunnel before the gateway can touch the request. Encrypted DNS in strict mode (DNS over HTTPS or DNS over TLS with plaintext fallback disabled) ensures the gateway can’t forge a response.” states the cybersecurity firm. “Most DNS encryption tools default to opportunistic mode, which permits plaintext fallback when encrypted resolution fails. That fallback is what the gateway redirects, making opportunistic mode insufficient; only strict mode closes the gap.”

ReliaQuest also caught something extra in about a third of cases: an attempt to abuse Windows’ automatic proxy discovery feature, known as WPAD.

WPAD is a Windows feature that automatically discovers proxy settings when a device connects to a network. In this campaign, attackers abused it by controlling DNS responses, potentially tricking Windows into loading a malicious proxy configuration. If successful, they could intercept traffic from browsers, authentication services, and enterprise apps. Because the traffic still uses HTTPS, the attack can blend in with normal network activity and be difficult to detect.

Pull that off and the attacker routes a much wider slice of an employee’s traffic, not just login attempts, through their own proxy. In a smaller number of cases, the attackers skipped credential theft entirely and went after Microsoft’s device-code sign-in flow instead, tricking users into approving a login they didn’t realize belonged to someone else. Approve that prompt and the attacker walks away with a valid, MFA-cleared session token, no password needed.

“In roughly one-third of observed cases—Windows devices that didn’t have Web Proxy Auto-Discovery (WPAD) disabled, or Mac devices—the attacker also attempted WPAD abuse. If successful, it routes all Windows application traffic through the attacker’s proxy, broadening the redirection surface well beyond authentication traffic.” continues the report. “This technique wasn’t documented in prior FrostArmada-linked reporting, making it one of the clearest distinctions between this campaign and previously observed APT28 activity.”

There’s a pattern connecting all this to previous campaigns. The tradecraft echoes a Russian-linked operation called FrostArmada, which hit home routers the same way earlier this year, and researchers tie both to the group known as APT28 (aka UAC-0001, aka Fancy Bear, Pawn Storm, Sofacy Group, Sednit, BlueDelta, and STRONTIUM). The link isn’t a smoking gun; it’s shared technique, not shared infrastructure, and the researchers say so plainly.

The fix is almost boringly simple, which is rare in this line of work. Force every corporate device onto an always-on VPN with full-tunnel routing, so DNS never touches the hotel network at all, and shut off split-tunnel exceptions that would let it sneak through anyway. Disable WPAD where nobody needs it, block Microsoft’s device-code flow at the identity provider unless someone has a real reason to keep it, and train people to check the certificate before they type a password on airport or hotel Wi-Fi.

None of this requires new budget or a six-month project. It requires someone actually flipping the switches that already exist.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Hotel Wi-Fi )