Captive portals on hotel and conference Wi-Fi networks have been hijacked to route guests through attacker infrastructure, serving fake browser and operating system updates that install Russian espionage malware.
According to research published by Microsoft Threat Intelligence on July 31, the campaign, which it named CaptiveCrunch, has run since early May and is attributed to Storm-2945, a sub-cluster of Midnight Blizzard.
The US and UK government have previously attributed Midnight Blizzard (also known as APT29, the Dukes, or Cozy Bear) to Russia's Foreign Intelligence Service, the SVR.
Microsoft is still investigating how the portals were compromised but noted commonalities in the equipment and management systems across affected networks, which it said could reflect access to shared services within the captive portal ecosystem rather than isolated venue compromises.
Fake Updates Triggered by Connectivity Checks
Rather than waiting for a user to visit a website, the threat actor answered the automated connectivity checks that browsers and operating systems issue on joining a new network. Those checks returned pages offering browser or system updates.
The landings used ClickFix techniques, presenting fake verification failures with paste-and-run instructions. Microsoft said some also served an APK, indicating possible Android targeting.
From July 16, some pages redirected users into device code authentication flows, instructing them to enter an attacker-supplied code on a genuine Microsoft sign-in page.
Microsoft said the technique was not new but embedding it in a captive portal made the request more likely to seem legitimate.
ReliaQuest, which reported part of the activity on July 23, found it at hotels, conference centers and other shared venues, targeting corporate travelers' accounts.
Three Tools, One Cover Story
The primary implant is CornFlake, a Go remote access trojan (RAT) that displays a fake progress window while installing itself, then registers as a Windows service with the display name Cloud Sync Service.
It carries keylogging, screenshots, microphone and webcam surveillance, browser credential theft and a remote shell, plus a watchdog routine that restores any persistence mechanism defenders remove.
A PowerShell infostealer called ChocoShell runs entirely in memory, disabling the Antimalware Scan Interface (AMSI) before harvesting browser cookies, saved passwords, Microsoft 365 single sign-on tokens and Wi-Fi credentials.
Its developer comments named specific Microsoft detection signatures and explained each evasion choice, which Microsoft said suggested AI-assisted code generation. The company said the actor used AI across a significant portion of the operation and thanked Anthropic and OpenAI for their support during the investigation.
Operators run the campaign from FruitStone, a web panel branded as a fictitious enterprise cloud product, matching the implant's cover story.
Microsoft's recommendations include treating hotel, conference and airport wireless as untrustworthy, preferring cellular or eSIM connectivity and never installing software offered through a captive portal. It also advised blocking device code flow where it is not required and deploying passkeys.
Captive portals on hotel and conference Wi-Fi networks have been hijacked to route guests through attacker infrastructure, serving fake browser and operating system updates that install Russian espionage malware.
According to research published by Microsoft Threat Intelligence on July 31, the campaign, which it named CaptiveCrunch, has run since early May and is attributed to Storm-2945, a sub-cluster of Midnight Blizzard.
The US and UK government have previously attributed Midnight Blizzard (also known as APT29, the Dukes, or Cozy Bear) to Russia's Foreign Intelligence Service, the SVR.
Microsoft is still investigating how the portals were compromised but noted commonalities in the equipment and management systems across affected networks, which it said could reflect access to shared services within the captive portal ecosystem rather than isolated venue compromises.
Fake Updates Triggered by Connectivity Checks
Rather than waiting for a user to visit a website, the threat actor answered the automated connectivity checks that browsers and operating systems issue on joining a new network. Those checks returned pages offering browser or system updates.
The landings used ClickFix techniques, presenting fake verification failures with paste-and-run instructions. Microsoft said some also served an APK, indicating possible Android targeting.
From July 16, some pages redirected users into device code authentication flows, instructing them to enter an attacker-supplied code on a genuine Microsoft sign-in page.
Microsoft said the technique was not new but embedding it in a captive portal made the request more likely to seem legitimate.
ReliaQuest, which reported part of the activity on July 23, found it at hotels, conference centers and other shared venues, targeting corporate travelers' accounts.
Three Tools, One Cover Story
The primary implant is CornFlake, a Go remote access trojan (RAT) that displays a fake progress window while installing itself, then registers as a Windows service with the display name Cloud Sync Service.
It carries keylogging, screenshots, microphone and webcam surveillance, browser credential theft and a remote shell, plus a watchdog routine that restores any persistence mechanism defenders remove.
A PowerShell infostealer called ChocoShell runs entirely in memory, disabling the Antimalware Scan Interface (AMSI) before harvesting browser cookies, saved passwords, Microsoft 365 single sign-on tokens and Wi-Fi credentials.
Its developer comments named specific Microsoft detection signatures and explained each evasion choice, which Microsoft said suggested AI-assisted code generation. The company said the actor used AI across a significant portion of the operation and thanked Anthropic and OpenAI for their support during the investigation.
Operators run the campaign from FruitStone, a web panel branded as a fictitious enterprise cloud product, matching the implant's cover story.
Microsoft's recommendations include treating hotel, conference and airport wireless as untrustworthy, preferring cellular or eSIM connectivity and never installing software offered through a captive portal. It also advised blocking device code flow where it is not required and deploying passkeys.