In a nutshell: Most people know to be careful when using hotel Wi-Fi, and Microsoft has just reminded us why. The Redmond firm has uncovered a Russian state-backed campaign that compromises hotel and conference Wi-Fi networks, redirecting travelers to fake login pages and malicious software disguised as legitimate system updates.
Microsoft calls the operation the almost cereal-sounding name of CaptiveCrunch. It says the attacks have been active since at least early May and are being carried out by Storm-2945, an operational sub-cluster of Midnight Blizzard. The infamous Midnight Blizzard, also known as Cozy Bear, APT29, and Nobelium, is linked to Russia's Foreign Intelligence Service, the SVR.
The campaign targets hospitality networks that use captive portals – the login or terms-and-conditions pages that appear when someone connects to guest Wi-Fi. Once the underlying equipment has been compromised, the attackers can manipulate DNS and HTTP traffic, silently directing users through infrastructure they control.
A previous investigation by ReliaQuest found compromised gateways in several US cities, India, and Saudi Arabia. Visitors from the financial, legal, healthcare, energy, retail, and professional-services industries were using the affected equipment, suggesting corporate travelers are the main targets rather than any particular business sector. Microsoft has not named the hotels involved or revealed how many people have been affected.
Some victims are sent to convincing Microsoft 365 login pages. One variation uses device-code authentication: the attacker begins a login session, then convinces the victim to enter an attacker-supplied code into a genuine Microsoft page. The user unknowingly authorizes the attacker's session, potentially bypassing multifactor authentication without the hacker needing to steal a password or one-time code.
Other victims see fake browser, Windows Update, Defender, DirectX, or network-repair prompts designed to make them install malware. BleepingComputer highlights several custom tools used in the operation, including CornFlake, a Go-based remote access trojan that displays a convincing progress window while establishing persistence as a Windows service called "Cloud Sync Service."
Once installed, CornFlake can record keystrokes, monitor the clipboard, capture screenshots, activate the microphone and webcam, steal browser credentials and session cookies, scan removable drives, exfiltrate files, and provide attackers with a remote shell.
Another tool, the in-memory PowerShell infostealer ChocoShell, focuses on browser passwords, Microsoft 365 SSO tokens, session cookies, and saved Wi-Fi credentials. There are also signs that Android users could be targeted through prompts to install an APK.
If all that weren't bad enough, Microsoft says the hackers have used AI to support a significant portion of the campaign. Unusually detailed comments left in the ChocoShell code suggest AI-assisted generation may have played a role in creating the malware.
Exactly how the captive-portal equipment is initially compromised remains under investigation. However, similarities between the hardware and management systems at several affected networks suggest the attackers may have gained access to shared services within the captive-portal ecosystem, rather than breaching every hotel individually.
The technique resembles a Russian Forest Blizzard campaign from earlier this year, in which thousands of home and small-office routers were hijacked to spy on Microsoft 365 users. It's also a modern version of the Darkhotel attacks reported more than a decade ago, when executives were infected through hotel Wi-Fi using fake software updates.
Microsoft recommends treating hotel, conference, and airport networks as untrusted. A cellular hotspot or another private connection is preferable, while an always-on, full-tunnel VPN and encrypted DNS in strict mode can provide additional protection. Simply switching to a public DNS service may not help because a compromised gateway can forge an unencrypted response before the request reaches the resolver.
Travelers should never install updates, certificates, security tools, or network-repair utilities offered through a captive portal. Updates should come through the operating system's trusted mechanism, and unexpected device-code requests should be rejected. Microsoft also recommends passkeys and phishing-resistant MFA, while organizations should disable Entra device-code authentication where it is not required.