Reported by 2 outlets

Timeline

1. original reporting

   CaptiveCrunch: Midnight Blizzard Sub-Cluster Weaponizes Hotel Wi-Fi Captive Portals to Attack Corporate Travelers Worldwide

   microsoft.com · 74d ago · August 1st, 2026

   ReliaQuest's hotel-Wi-Fi compromise reporting was covered Jul 25. New today: Microsoft attributes the broader campaign to SVR sub-cluster Storm-2945 and publishes full malware analysis.

   Microsoft Threat Intelligence disclosed CaptiveCrunch, an active campaign by Storm-2945 — assessed as an operational sub-cluster of Midnight Blizzard (SVR) — that hijacks captive portal networks at hotels, conference centers, and other shared venues to redirect traveling employees through attacker infrastructure. Since early May 2026, Storm-2945 has manipulated DNS and HTTP traffic on compromised guest networks so that browsers' automatic connectivity checks receive malware disguised as fake browser or OS updates; ClickFix prompts then push the victim to execute the payload. Microsoft has confirmed widespread compromise of hospitality Wi-Fi networks across multiple countries, with the goal of accessing corporate travelers' accounts. ReliaQuest (July 23) had separately documented the doppelganger-domain device-code phishing half of the operation.

   Tooling (all newly documented):

   • CornFlake — a full-featured Go RAT: dropper displays convincing fake update/scan windows ("Working on updates… Don't turn off your computer"), persists as service svchost32 ("Cloud Sync Service") plus Run keys and scheduled tasks with a watchdog that restores removed persistence. Features keylogging, clipboard and screenshot capture, audio (WASAPI) and webcam surveillance, ChromeKatz-based credential theft with App-Bound Encryption bypass, file exfiltration (1,000 files/500 MB per cycle), USB monitoring, and a remote shell. C2 uses ECDH P-256 ephemeral key exchange with per-session keys.

   • ChocoShell — an in-memory PowerShell infostealer targeting browser cookies, saved passwords, Microsoft 365 SSO tokens, and Wi-Fi credentials. Disables AMSI via .NET reflection, evades sandboxes with timing checks, and uses three silent UAC bypasses (SilentCleanup task hijack, wsreset.exe COM hijack, sdclt.exe folder hijack). Also launches browsers with --remote-debugging-port to exfiltrate plaintext cookies via CDP — bypassing ABE entirely — and steals Token Broker (.tbres) tokens for session replay. C2: 213.145.86[.]112.

   • FruitStone — the operator C2 panel, branded as "CloudSync Console / Acuity Systems, Inc." to blend in, with a campaign builder that compiles new CornFlake payloads on demand.

   Microsoft notes Storm-2945 uses AI to support a significant portion of operations, and ChocoShell's fully-commented code style suggests AI-assisted generation. ClickFix landings also instruct Android users to install a malicious APK.

   Hunting hypothesis: Correlate file creation within ~2 minutes of NCSI connectivity checks (msftconnecttest.com, captive.apple.com, etc.) on devices joining guest networks; alert on svchost32.exe under %APPDATA%, service "Cloud Sync Service," and beaconing to ms365-device[.]com / ms365-live[.]com.

   Action: Treat hotel and conference Wi-Fi as hostile. Use cellular/SSE connections for corporate work, never reuse corporate credentials on guest-portal registration pages, and enforce phishing-resistant MFA with device-code flows blocked via conditional access.

2. update from malware.news

   CaptiveCrunch: Midnight Blizzard Weaponizes Hotel Wi-Fi Captive Portals to Steal Microsoft 365 Credentials

   malware.news · 63d ago · August 11th, 2026

   IntroductionOn July 31, Microsoft Threat Intelligence reported an ongoing credential theft campaign tracked as CaptiveCrunch. Microsoft attributes this activity to Storm-2945, a sub-cluster of Midnight Blizzard (also known as APT29, Cozy Bear, NOBELIUM, and BlueBravo), a threat group linked to Russia. The campaign manipulates DNS and HTTP traffic on captive portal networks at hospitality venues, redirecting victims to attacker-controlled infrastructure for Microsoft 365 credential harvesting, device code phishing, and malware delivery.Evidence suggests that Storm-2945 compromised shared captive portal services used by hotels, conference centers, and similar venues rather than breaching each location individually. ReliaQuest identified compromised gateways in several U.S. cities, India, and Saudi Arabia. Although the initial access vector remains under investigation, CaptiveCrunch targets travelers across a broad range of sectors. Microsoft assesses that Storm-2945 leveraged AI tools to support a significant portion of its operations, including the development of the CornFlake and ChocoShell malware. This assessment is based partly on extensive and unusually detailed comments found in the malware’s code. Microsoft also acknowledged contributions from Anthropic and OpenAI to the investigation. Recommendations1. Zscaler Client Connector (ZCC) — Full Tunnel ModeEnable full tunnel so all traffic