Microsoft has attributed a campaign that hijacks hotel and conference Wi-Fi captive portals to Storm-2945, an operational sub-cluster of Midnight Blizzard, the Russian state-sponsored group also tracked as APT29, Cozy Bear, the Dukes, and Yttrium, and believed to be backed by Russia’s Foreign Intelligence Service (SVR). The operation, named CaptiveCrunch, redirects travelers to fake software updates and then harvests Microsoft 365 credentials through a chain of surveillance-capable malware.
On compromised networks, the captive portal gateway also serves as the DNS resolver for connected devices. Administrator control over the gateway lets the operators forge DNS answers and redirect traffic to pages that impersonate browser or operating system updates. The attack relies on ClickFix-style social engineering that tells victims to open Terminal or Windows utilities and run attacker-supplied commands; the gateway determines where users are sent but does not silently infect endpoints by itself.
How Compromised Captive Portals Forge DNS and Redirect Guests
Microsoft has observed the traffic manipulation since early May across hospitality networks in several countries. No hotel, venue, or captive portal vendor has been named. The initial compromise vector remains under investigation; security firm ReliaQuest has assessed low-to-medium confidence that exposed management interfaces and weak or reused admin credentials may have provided access.
CornFlake RAT and ChocoShell as the Malware Chain
Two malware families carry the payload side of the campaign. CornFlake is a Go-based Windows remote access trojan that copies itself to %APPDATA%svchost32svchost32.exe and registers a service named “Cloud Sync Service.” It can take idle-triggered screenshots, record clipboard and active-window titles, steal browser cookies and saved passwords including Chrome App-Bound Encryption-protected cookies, scan removable media, and open a remote shell. ChocoShell is an in-memory PowerShell stealer that collects Microsoft 365 and Azure AD access and refresh tokens plus Web Account Manager (WAM) tokens from .tbres files in the Token Broker cache, enabling session replay.
The Device Code Authentication Redirect
Since mid-July, some CaptiveCrunch landing pages have redirected guests into Microsoft’s device code authentication flow. A guest who enters the attacker-supplied code can grant an attacker-controlled session with MFA-satisfied access, meaning the stolen tokens can bypass password changes and survive a credential reset.
Storm-2945 Attribution to the Midnight Blizzard Sub-Cluster
The attribution rests on Microsoft’s own assessment. ReliaQuest had documented overlapping Microsoft-impersonating domains eight days earlier and flagged the campaign’s technical similarity to APT28, also known as Forest Blizzard, but stopped short of assigning responsibility. Microsoft’s analysis ties CaptiveCrunch specifically to Storm-2945 and the Midnight Blizzard umbrella. The operational markers point to a professional and staffed campaign: the operators manage their infrastructure through a web-based command-and-control panel called FruitStone, target Android users with ClickFix-style APK downloads, and pair two distinct malware families across the same delivery chain. The overlapping-domain evidence from ReliaQuest indicates the domain infrastructure was already in operation before Microsoft published its attribution.
Defense for Travelers and Microsoft 365 Administrators
ReliaQuest recommends always-on, full-tunnel VPNs so DNS queries go through corporate resolvers rather than a hotel gateway. Microsoft recommends blocking device code flows via Conditional Access where they are not needed. Travelers are advised to reject software updates, certificates, and troubleshooting tools offered through captive portals and to use private connections.
The most consequential aspect of the campaign for defenders is the token-stealing layer. Because Microsoft 365 and Azure AD tokens can outlive a password reset and satisfy multi-factor authentication, the damage from CaptiveCrunch is not limited to the session a traveler used in a hotel lobby. Organizations should treat any business traveler who connected through hospitality Wi-Fi during the observed period as a candidate for token review, since the window of exposure is defined by when the portal was controlled rather than by what the employee did on the endpoint.
