Russian threat actor Midnight Blizzard (APT29) has been linked to a global campaign compromising hotel and conference center Wi-Fi networks to steal Microsoft 365 credentials and deliver malware. Microsoft named the operation CaptiveCrunch and attributes it to Storm-2945, a sub-cluster of Midnight Blizzard.

The campaign has been active since at least early May 2026, with device code phishing operations dating back to February. Attackers manipulate DNS settings on captive portal equipment to intercept connections, redirect victims to phishing pages, and deploy two new malware families: CornFlake (a Go-based RAT) and ChocoShell (an in-memory PowerShell credential stealer).

Attack Chain: From Captive Portal to Credential Theft

The attack begins when travelers connect to compromised hotel or conference Wi-Fi networks. The threat actor modifies DNS and HTTP traffic on the captive portal infrastructure, allowing interception of user connections.

Microsoft and ReliaQuest were unable to determine the exact initial compromise vector but noted signs of breaches in shared infrastructure rather than isolated devices. After DNS modification, attackers redirect victims through three primary paths:

1. Microsoft 365 login phishing pages: impersonating legitimate Entra ID authentication
2. Device code phishing: abusing Microsoft Entra device code flows to capture tokens
3. Fake browser/OS update pages: delivering malware via ClickFix prompts (observed since July)

A fourth vector targets Android devices with malicious APK files delivered through the same ClickFix mechanism.

CornFlake: Go-Based RAT with Extensive Capabilities

CornFlake is a sophisticated remote access trojan written in Go. Microsoft assesses that AI tools were likely used in its development based on extensive code comments.

Capabilities

• Remote shell access
• Keylogging and clipboard monitoring
• Screenshot capturing
• Microphone and webcam surveillance
• Browser credential and cookie theft
• Microsoft 365 session token theft
• File exfiltration and USB monitoring
• System reconnaissance

Persistence Mechanisms

CornFlake disguises itself as "Cloud Sync Service" and employs multiple persistence techniques:

• Windows service registrations
• Registry run keys
• Scheduled tasks
• Watchdog routine that restores disabled persistence mechanisms

When executed, CornFlake displays a fake progress window (configurable as Windows update, Defender scan, disk optimization, network diagnostics, browser update, or document viewer installer) to distract the user while copying itself to %AppData%.

ChocoShell: In-Memory PowerShell Credential Stealer

ChocoShell operates entirely in memory, targeting:

• Browser cookies and saved passwords
• Microsoft 365 and Azure AD tokens
• Wi-Fi credentials

The malware leverages PowerShell's reflective loading capabilities to avoid disk artifacts, making detection more difficult for traditional endpoint solutions.

FruitStone: Threat Actor Management Panel

Microsoft discovered an unprotected web-based management panel called FruitStone used by Storm-2945 to:

• Manage infected systems
• Browse victim files
• Execute PowerShell commands remotely
• Capture screenshots and keystrokes

The exposed panel provided valuable intelligence into the threat actor's operations and tooling.

Indicators of Compromise

Malware Hashes (SHA256)

CornFlake samples: - a1b2c3d4e5f6... (multiple variants observed) - Go compiler artifacts consistent across samples ChocoShell samples: - PowerShell scripts with reflective loading patterns - Obfuscated via Invoke-Expression chains

Network Indicators

• Captive portal DNS manipulation (monitor for unexpected DNS responses on hospitality networks)
• Connections to FruitStone management panel infrastructure
• ClickFix delivery domains (rotating, short-lived)

Behavioral Indicators

• Fake Windows update/defender/diagnostic windows appearing unexpectedly
• Unusual PowerShell execution from user context
• Browser credential access from non-browser processes
• Microphone/webcam activation without user consent

Attribution: Midnight Blizzard (APT29)

Microsoft attributes CaptiveCrunch to Storm-2945, a sub-cluster of Midnight Blizzard (also tracked as APT29, Cozy Bear, Nobelium). This Russian state-sponsored actor has a long history of targeting governments, NGOs, and technology sectors.

Key attribution factors:

• Infrastructure overlap with previous Midnight Blizzard campaigns
• TTP consistency: DNS manipulation, credential phishing, token theft
• Targeting alignment: travelers, hospitality sector, Microsoft 365 tenants
• Malware development patterns suggesting AI-assisted coding

Mitigation Recommendations

For Travelers and Employees

1. Treat hotel/conference Wi-Fi as untrusted: use private cellular or managed corporate connections whenever possible
2. Avoid software updates via captive portals: legitimate OS/browser updates never originate from hotel Wi-Fi landing pages
3. Use phishing-resistant MFA: FIDO2 security keys or passkeys (though see Pass-ta-key research below)
4. Disable Microsoft Entra device code authentication when not explicitly needed
5. Never use corporate credentials to register for guest Wi-Fi networks

For Security Teams

1. Block device code authentication flows unless explicitly required for legitimate scenarios
2. Monitor for anomalous DNS responses on corporate devices connecting to hospitality networks
3. Deploy phishing-resistant authentication (FIDO2, certificate-based auth) across the organization
4. Implement conditional access policies blocking authentication from unmanaged networks
5. Audit Entra ID sign-in logs for device code flow anomalies and impossible travel patterns

For Hospitality and Venue Operators

1. Segment captive portal infrastructure from management networks
2. Monitor DNS configuration changes on portal equipment
3. Implement integrity checking on captive portal firmware and configuration
4. Isolate guest networks with strict egress filtering

Detection Rules

Sigma Rule: Suspicious Captive Portal DNS Modification

Sigma Rule: CornFlake Fake Update Window

YARA Rule: CornFlake RAT

Key Takeaways

1. Hospitality Wi-Fi is a high-risk attack surface: nation-state actors actively compromise captive portal infrastructure to target travelers
2. AI-assisted malware development is accelerating: CornFlake's code structure suggests AI tooling, lowering barrier for sophisticated RAT creation
3. Device code phishing remains effective: Microsoft Entra device code flows are actively abused; disable when not needed
4. ClickFix social engineering evolves: fake update prompts now deliver both Windows and Android payloads
5. Defense-in-depth required: no single control (MFA, EDR, network monitoring) is sufficient; layer protections

Conclusion

The CaptiveCrunch campaign demonstrates how threat actors exploit the trust inherent in hospitality networks. By compromising shared captive portal infrastructure, Midnight Blizzard gains access to a high-value victim pool: business travelers with corporate Microsoft 365 accounts. The introduction of CornFlake and ChocoShell — likely AI-assisted malware — signals a trend toward more sophisticated, rapidly developed tooling.

Organizations must treat public Wi-Fi as hostile territory, enforce phishing-resistant authentication, and monitor for the TTPs described above. Hotel and venue operators share responsibility for securing the infrastructure that attackers are weaponizing.

---

Sources:

• Microsoft Security Blog: CaptiveCrunch
• ReliaQuest: Hackers Hijack Hotel Wi-Fi DNS
• BleepingComputer: Hotel Wi-Fi Attacks