APT29 Hits Hotel Wi-Fi: Steals M365 Credentials with Malware

Microsoft attributes the CaptiveCrunch campaign to Storm-2945, a Midnight Blizzard sub-group, which compromises hotel captive portals to hijack DNS and steal corporate credentials.

Microsoft has attributed a global cyber-espionage campaign dubbed CaptiveCrunch to Storm-2945, an operational sub-group of Midnight Blizzard. The operation compromises hotel and conference-center Wi-Fi networks to intercept corporate credentials and plant surveillance malware on business travelers' devices. Activity is documented from at least February 2026, with a significant escalation in early May 2026 when attackers began modifying DNS settings on captive-portal gateways to create adversary-in-the-middle positions. On August 3, 2026, Microsoft publicly disclosed the attribution, marking one of the first documented APT campaigns to systematically exploit the hospitality sector's shared Wi-Fi infrastructure as a primary vector.

Key Takeaways

Microsoft attributes the CaptiveCrunch campaign to Storm-2945, a Midnight Blizzard (APT29) sub-group assessed as linked to Russia's SVR.
Attackers modify DNS and HTTP traffic on hotel captive-portal gateways, creating adversary-in-the-middle positions without requiring prior device compromise.
Malware identified: CornFlake, a Go-based RAT with keylogging, screen/audio/webcam capture, and multi-layered persistence; and ChocoShell, a second family detected by Microsoft.
ReliaQuest had documented the same infrastructure eight days before Microsoft, noting tradecraft similar to APT28 but without definitive attribution.

How the Attack Works: The Captive Portal as a Weapon

Attackers do not need to breach individual smartphones or laptops. According to Microsoft and ReliaQuest, the target is the gateway managing the captive portal itself — the access point that redirects hotel guests to a login page before granting internet access. By compromising this node, Storm-2945 operators gain control of the DNS resolver assigned to connected devices and can manipulate DNS responses and HTTP traffic.

The adversary-in-the-middle position is not silent in the technical sense: as The Hacker News analysis noted, "the gateway controls where the user is sent, but does not silently infect the endpoint. The victim still has to download or execute the payload." However, the upstream-of-TLS placement allows operators to serve convincing Microsoft 365 phishing pages, redirect to compromised authentication flows, and deliver fake updates that exploit the ClickFix technique to trick users into manually executing commands.

Microsoft observed abuse of the Microsoft Entra ID device code flow starting in July 2026. On July 16, 2026, some CaptiveCrunch landing pages began redirecting victims to phishing pages exploiting this authentication flow. The device code flow, designed for input-constrained devices such as smart TVs or printers, generates a code the user enters on another device to complete authentication: if the portal presents an attacker-controlled code, credentials and OAuth tokens can be intercepted downstream.

CornFlake and ChocoShell: The Surveillance Arsenal

Microsoft identified two malware families. CornFlake is a remote access trojan written in Go that masquerades as "Cloud Sync Service." Its documented capabilities include keylogging, screenshot capture, audio and webcam video recording, clipboard monitoring, and exfiltration of collected data. Persistence is built on multiple layers: Windows service registration, registry Run keys, scheduled tasks, and a watchdog routine that ensures reactivation if interrupted.

The second family, ChocoShell, was identified by Microsoft, though the dossier does not clarify whether it was observed actively in-the-wild or only analyzed as a related component. Separately, researchers discovered an unprotected web panel named FruitStone, used by attackers to manage infected systems. Exposure of this administrative tool gave Microsoft visibility into the campaign's command-and-control infrastructure.

A distinctive detail flagged by Microsoft concerns malware development: "Based on extensive comments in the code, Microsoft assesses that AI tools were likely used to develop the two malware families." This assessment, while not a forensic certainty, indicates Storm-2945 operators may have integrated generative assistants into their development workflow, potentially lowering the barrier to producing commented, structured code.

The Initial Vector No One Has Closed Yet

Microsoft has not determined the initial compromise vector for the captive-portal gateways. The source suggests access to shared infrastructure — rather than isolated devices — is the most plausible mode. ReliaQuest hypothesized with low-to-medium confidence that a combination of exposed management interfaces and weak or reused credentials may have provided initial access, but this remains a hypothesis, not a confirmation.

The dossier does not specify the number of hotels or conference centers actually compromised, nor the number of victims or stolen accounts. The identity of the captive-portal infrastructure providers involved does not emerge. These gaps are relevant for enterprises assessing risk: without knowing which hotel chains or gateway manufacturers were hit, mitigation cannot be selective but must be universal.

Attribution to Storm-2945 as a Midnight Blizzard sub-group is solid per Microsoft; the UK/US government attribution to the SVR covers Midnight Blizzard as a whole, not CaptiveCrunch specifically. No infrastructure overlaps directly linking the actor to Storm-2945 at the state-attribution level for this specific incident have emerged to date.

What to Do Now

For enterprises with traveling employees, converging sources point to four priority tracks. First: mandatory full-tunnel VPN for all traffic, not just corporate applications, from the moment of connection to the captive portal. Second: disable the Microsoft Entra ID device code flow where not strictly necessary, reducing the attack surface for this specific vector documented from July 2026. Third: recalibrate remote-access policies to treat public Wi-Fi networks, even business-grade ones, as untrusted by default. Fourth: targeted training against ClickFix techniques, which trick users into copying and pasting seemingly innocuous but malicious commands.

For the hospitality sector, supply-chain responsibility for shared Wi-Fi infrastructure emerges as an open question. Captive-portal gateways are not passive peripherals but critical nodes in the security chain: their compromise exposes hundreds or thousands of users simultaneously, with an amplified effect compared to traditional endpoint attacks.

"Microsoft has linked a global campaign targeting hospitality Wi-Fi networks to the Russian threat actor Midnight Blizzard, also known as APT29" — BleepingComputer, reporting on Microsoft

Why This Changes the Stakes

The business traveler's paradox closes bitterly: the hotel selected for security, cleanliness, and strategic location becomes the weak link in the chain. Standard best practices — verify the HTTPS padlock, check the certificate, avoid open networks — assume a trustworthy DNS resolver. When the gateway itself lies about responses, the browser shows exactly what the attacker wants it to show.

The CaptiveCrunch campaign introduces no zero-day vulnerabilities in gateway software; it introduces the awareness that the hospitality sector's shared infrastructure is a valid target for state-level APTs. The question is no longer whether a hotel in your preferred chain can be compromised, but when your organization will stop treating hotel Wi-Fi as a trusted connection.

Frequently Asked Questions

Can a compromised captive portal bypass HTTPS?

The gateway controls the DNS resolver and can redirect to attacker-controlled domains before the browser establishes TLS. The legitimate site's HTTPS certificate is not broken, but the user is sent elsewhere. Effective protection requires a VPN or out-of-band verification of endpoints.

Is the CornFlake malware detectable by antivirus?

The dossier provides no information on specific detection rates or evasion. CornFlake uses masquerading techniques such as a plausible service name and multi-layered persistence, but its identification by Microsoft suggests indicators of compromise are available for those actively hunting them.

What sectors beyond hospitality are at risk?

The source documents no expansion of the campaign beyond hospitality. However, any infrastructure with shared captive portals and exposed gateways — airports, business lounges, conference centers, co-working spaces — presents an architecture technically vulnerable to the same attack model.

Information verified against cited sources and current as of publication.

Sources

Sources and references