Microsoft has attributed a global campaign targeting hospitality Wi-Fi networks to the Russian threat actor Midnight Blizzard (APT29). The campaign, named CaptiveCrunch, manipulates DNS settings on hotel and conference Wi-Fi equipment to steal Microsoft 365 accounts.
Microsoft links this activity to Storm-2945, a sub-cluster of Midnight Blizzard, and has identified two malware families, CornFlake and ChocoShell, used for persistent access, credential theft, surveillance, and data exfiltration.
Microsoft believes the campaign has been active since at least early May, though the threat actor has run device and OAuth code phishing operations since February. The activity was previously disclosed in a report from cybersecurity company ReliaQuest.
How the CaptiveCrunch Attack Works
The attackers manipulate DNS and HTTP traffic on networks served by captive portal equipment, allowing them to intercept user connections to hotel and conference center Wi-Fi.
Like ReliaQuest, Microsoft could not determine the exact initial compromise but noted signs of breaches in shared infrastAfter modifying DNS settings, attackers can redirect victims in three ways.
The first method leads to phishing pages impersonating Microsoft 365 login portals. The second uses device code phishing pages that exploit Microsoft Entra ID authentication flows, which Microsoft has observed since July.
The third, newly disclosed, involves fake browser and operating system update pages that deliver malware to Windows through ClickFix prompts requesting user verification. Microsoft also found evidence that some ClickFix landings target Android devices with an APK file.ting Android devices with an APK file.
Microsoft analyzed the two Windows malware families.
CornFlake is a Go-based remote access trojan with a broad capability set: remote shell access, keylogging, clipboard monitoring, screenshot capturing, microphone and webcam surveillance, browser credential and cookie theft, Microsoft 365 session token theft, file exfiltration, USB monitoring, and system reconnaissance.
When executed, it shows a fake progress window to distract the user while copying itself to %AppData% for persistence. The fake window can be configured to appear as a Windows update screen, a Defender virus scan, a disk optimization utility, a network diagnostics tool, a browser update prompt, or a document viewer installer.
CornFlake disguises itself as “Cloud Sync Service” to appear legitimate and uses several persistence mechanisms, including Windows service registrations, registry run keys, named tasks, and a watchdog routine that restores any removed persistence method.
ChocoShell is an in-memory PowerShell credential stealer targeting browser cookies, saved passwords, Microsoft 365 and Azure AD tokens, and Wi-Fi credentials.
Based on extensive code comments, Microsoft assesses that AI tools were likely used to develop both malware families. Microsoft also discovered an unprotected web-based management panel, FruitStone, which the threat actor used to manage infected systems, browse victim files, execute PowerShell commands, and capture screenshots and keystrokes.
How to Protect Against the Wi-Fi Attack And What Still Hasn’t Been Confirmed
Microsoft recommends treating hotel and conference Wi-Fi as untrusted. Users and organizations can reduce risk by taking the following measures:
- Use a private cellular or managed connection instead of hotel or conference Wi-Fi whenever possible.
- Avoid installing software updates or tools offered through captive portals, as these may deliver ClickFix malware.
- Adopt phishing-resistant authentication with MFA and passkeys rather than relying on passwords alone.
- Disable Microsoft Entra device code authentication when not needed, as this campaign exploits that process.
- Avoid using corporate credentials to register for guest Wi-Fi networks.
- Treat update prompts, Defender scan screens, and similar system dialogs on untrusted networks as suspicious, due to CornFlake’s disguises.
Microsoft, like ReliaQuest, could not determine the exact method of initial compromise on the captive portal equipment, noting only signs of breaches in shared infrastructure.
The full scope of affected hotels and conference venues is not detailed, and Microsoft’s assessment that AI tools were used to develop the malware is based on code comments rather than confirmed attribution of the development method.
The extent of the Android-targeting activity through the APK file is also not fully detailed in the current reporting.
Thank you for being a Ghacks reader. The post Microsoft Links Hotel Wi-Fi Attacks Stealing Microsoft 365 Accounts to Russian Hackers appeared first on gHacks.
