Midnight Blizzard Turns Hotel Wi-Fi Into a Trap for Corporate…

Storm-2945, a Midnight Blizzard sub-cluster, compromises captive portal networks worldwide to deliver the CornFlake RAT and steal Microsoft Entra ID credentials. Microsoft

Microsoft Threat Intelligence published an advisory on July 31, 2026 detailing the CaptiveCrunch campaign: Storm-2945, a sub-cluster attributed to Midnight Blizzard, has manipulated hospitality Wi-Fi networks with captive portals across multiple countries since May 2026 to distribute malware and steal Microsoft Entra ID credentials. The paradigm shift is stark: the attack originates not from a phishing email but from the hotel infrastructure itself, which travelers regard as routine and legitimate.

The operation exploits two converging technical levers: automatic hijacking of browser connectivity checks to serve fake updates, and abuse of the device code authentication flow to bypass the perception of MFA. Microsoft explicitly thanks Anthropic and OpenAI for their collaboration in the investigation, confirming the use of AI as an operational accelerator.

Key Takeaways

Storm-2945, an operational sub-cluster of Midnight Blizzard (Russian SVR), manipulates DNS and HTTP traffic on hospitality captive portal networks worldwide since May 2026.
The CornFlake RAT, written in Go, installs to %APPDATA%\svchost32\svchost32.exe with redundant persistence: Windows services, Registry Run keys, scheduled tasks, and an active watchdog.
The C2 uses ECDH P-256 with a session key derived via SHA-256 over a custom JSON protocol; traffic captures cannot be decrypted without the session-specific private key.
ReliaQuest identified doppelganger domains for adversary-in-the-middle phishing abusing the device code authentication flow in Microsoft Entra ID, reported July 23, 2026.
Microsoft recommends treating public/hospitality networks as untrusted, preferring mobile hotspots, and blocking device code authentication where possible.

"Since early May 2026, Microsoft Threat Intelligence has observed Storm-2945, a sub-cluster of Midnight Blizzard, conducting widespread but targeted traffic manipulation attacks involving hospitality sector networks served by captive portals worldwide."

How the Captive Portal Trap Works

The initial mechanism is insidious because it requires no deliberate user action. When a device connects to a hospitality Wi-Fi network, the operating system automatically runs connectivity checks to detect a captive portal. Storm-2945 manipulates these checks at the DNS and HTTP level, redirecting the browser to landing pages that mimic system updates: Windows Update, Microsoft Defender, DirectX, Visual C++ Redistributable, even Netflix.

This technique, known as ClickFix, presents configurable fake progress windows at build time. Five variants are documented: winupdate, defender, directx, vcredist, netfix. The window occupies the victim's attention while the dropper copies itself to %APPDATA%\svchost32\svchost32.exe, mimicking the legitimate system process name svchost.exe. The registered service name is "Cloud Sync Service," further camouflage.

Microsoft notes "similarities" across compromised networks in different countries, suggesting that access "might not be limited to isolated compromises of individual venues and could reflect access to shared services within portions of the captive portal ecosystem." The initial compromise vector remains under investigation: it is unclear whether access stems from stolen credentials, a supply chain compromise of the provider, or a specific vulnerability in the management software.

CornFlake: RAT Architecture and Persistence

CornFlake is a Windows RAT written in Go with full surveillance capabilities: keylogging, clipboard monitoring, screenshots, audio/video capture, file exfiltration, credential and session token theft, and a remote shell. Its C2 architecture is designed to resist passive forensic analysis. The handshake uses ECDH P-256 for ephemeral key exchange, with session key derivation via SHA-256. The application protocol is custom JSON, encapsulated in the encrypted channel. Without the private key for the specific session, traffic captures remain undecipherable.

A distinctive element is the runtime configuration via a sync.dat file, which enables hot reconfiguration of the C2 without redeploying the malware. The persistence mechanism is redundant and self-healing: beyond service registrations, Registry Run keys, and scheduled tasks, CornFlake implements a persistence watchdog that runs continuously to restore any removed persistence mechanism. This structure makes manual cleanup impractical without first terminating the watchdog process.

Microsoft also documents "indications" of Android targeting via APKs distributed through the same ClickFix landing pages, but the actual extent of this vector is unquantified.

Device Code Phishing: The Pivot from Local Network to Cloud Identity

After RAT installation or in parallel with the captive portal hijack, Storm-2945 pivots to cloud identity. ReliaQuest, cited in the Microsoft advisory, reported on July 23, 2026 the use of doppelganger domains mimicking Microsoft online services for adversary-in-the-middle operations. The specific target is the device code authentication flow in Microsoft Entra ID.

This flow is designed for devices without input capabilities: the user enters a code on another device to authorize access. In an AitM scenario, the attacker intercepts the code, enters it into a freshly initiated legitimate session, and obtains valid tokens. The victim sees an authentic Microsoft authentication screen and concludes — incorrectly — that MFA protected the access. Storm-2945 is linked to Storm-2372, a Midnight Blizzard initial-access sub-cluster, for this same device code and OAuth phishing technique, as well as for exfiltration via Microsoft Graph.

Abuse of the device code flow is not a protocol vulnerability but a perceived weakness: it works as specified, but the captive portal context voids the trust assumptions on which it relies.

AI as an Operational Velocity Multiplier

Microsoft has "observed Storm-2945 leveraging AI to support a significant portion of these operations." The specific role is not detailed in technical terms — it is unclear whether AI generates payloads, iterates malware, or supports social engineering — but the explicit acknowledgment of collaboration with Anthropic and OpenAI indicates that the intelligence community and AI labs are sharing compromise indicators on state-sponsored operations.

This observation carries weight beyond the specific campaign: it signals that AI use by SVR-linked APTs has moved from speculation to documented observation. The speed of malware iteration, the variability of ClickFix landing pages, and the scalability of captive portal targeting are all compatible with intelligent automation.

What to Do Now

Microsoft issued direct operational recommendations, also summarized by Forbes' Zak Doffman. The four priorities are:

Treat public and hospitality networks as untrusted. This is the foundational recommendation that changes the default posture: no longer "cautious but connected," but "connected only if necessary and never for sensitive operations."

Prefer mobile hotspot or cellular connectivity for corporate work on the road. Cellular bypasses the captive portal infrastructure entirely, eliminating the documented attack vector.

Avoid software updates on captive portal networks. If the browser or system signals a required update, defer the operation until a trusted connection. Legitimate updates have no urgency that justifies the risk.

Block device code authentication where possible via Conditional Access policy, and restrict the flow to strictly necessary use cases. This reduces the attack surface for the AitM pivot to cloud identity.

Microsoft does not name specific captive portal equipment providers, so filtering by vendor or verifying patches is not possible.

The Lesson of Systemic Travel Risk

CaptiveCrunch represents an escalation in the logic of mobile targeting. APTs have long viewed corporate travelers as soft targets — outside the corporate perimeter, tired, inclined to connect to any available network. The novelty is the attack on the shared infrastructure serving these travelers, turning individual risk into systemic risk. No personalized spear-phishing is needed if the hotel's captive portal is already compromised.

The combined use of network hijacking, a Go-based RAT with advanced C2, and abuse of legitimate cloud identity protocols demonstrates an operational maturity that makes traditional perimeter defense difficult. The only effective response is behavioral change: assume the network that was mundane background yesterday is hostile today.

Information verified against cited sources and current as of publication.

Sources

Sources and references