Travelers connecting to hotel Wi-Fi networks face a new and insidious threat: a sophisticated campaign leveraging hijacked captive portals to deliver a potent remote access trojan. **Microsoft** researchers have detailed this operation, dubbed **CaptiveCrunch**, which is attributed to **Storm-2945**, an operational sub-cluster of the notorious **Midnight Blizzard** (also known as APT29 or Cozy Bear).  ### The Modus Operandi: DNS Poisoning and Deception The attackers gain administrative control of the captive portal gateway, which also functions as the DNS resolver for connected devices. This control allows them to forge DNS answers, redirecting users attempting to connect to a fake browser or operating system update page. Some of these deceptive pages employ **ClickFix** instructions, prompting victims to execute attacker-supplied commands in a terminal or Windows utility. While the gateway directs the user, it does not silently infect the endpoint; victim interaction is still required to download or execute the payload. **Microsoft** has observed this traffic manipulation since early May across hospitality networks in several countries. While no specific hotels or vendors have been named, the technique highlights a significant vulnerability in public Wi-Fi infrastructure. ### CornFlake RAT: A Comprehensive Surveillance Tool The primary payload delivered is **CornFlake**, a Go-based Remote Access Trojan. Once executed, it copies itself to `%APPDATA%\svchost32\svchost32.exe` and establishes persistence by registering the `svchost32` service under the display name **Cloud Sync Service**. A fake progress window keeps the victim distracted during this process. **CornFlake** is a highly capable implant, able to: * Capture idle-triggered screenshots. * Record clipboard contents and active window titles. * Steal browser cookies and saved passwords, including those protected by **Chrome App-Bound Encryption**. * Scan removable media. * Open a remote shell. It also utilizes a Registry Run key and a scheduled task for persistence, with a watchdog mechanism to restore any removed components. ### ChocoShell: Targeting Authentication Tokens In addition to **CornFlake**, researchers identified **ChocoShell**, an in-memory PowerShell stealer. This tool focuses on collecting **Microsoft 365** and **Azure Active Directory** access and refresh tokens, as well as Web Account Manager (WAM) tokens from `.tbres` files in the Token Broker cache. The theft of these tokens can enable session replay, bypassing the need for browser cookies.  ### MFA Bypass and Broader Implications Since mid-July, some **CaptiveCrunch** landing pages have redirected guests into **Microsoft's** device code authentication flow. By entering the attacker-supplied code on **Microsoft's** legitimate sign-in page, the attacker can gain multi-factor authentication (MFA)-satisfied access to the victim's session. **Microsoft** recommends blocking this flow via Conditional Access where it is not explicitly needed. While the reports document active redirection and malware delivery, the full scope of successful compromises or stolen accounts remains unquantified. **Microsoft** noted common equipment and management systems across the affected networks, suggesting potential access to shared services within the captive portal ecosystem. This could imply that compromises might not be isolated to individual venues.  ### Attribution and Recommendations **ReliaQuest** had previously documented similar **Microsoft**-impersonating domains and overlapping infrastructure, noting tradecraft resemblance to **APT28** (**Fancy Bear** or **Forest Blizzard**), another Russian state-sponsored group. However, **Microsoft** firmly attributes **CaptiveCrunch** to **Storm-2945**, a sub-group of **Midnight Blizzard**, which the U.S. and U.K. governments link to Russia's Foreign Intelligence Service (SVR). The initial compromise vector for these networks is still under investigation. **ReliaQuest** suggests that exposed management interfaces combined with weak or reused administrator credentials may have provided access, though visibility constraints prevent definitive confirmation. For IT security professionals and privacy-conscious users, the recommendations are clear: * **Always-on, Full-Tunnel VPN**: Utilize a VPN that sends DNS queries through trusted corporate resolvers, bypassing the venue's gateway. * **Reject Untrusted Software Updates**: Never accept software updates, certificates, browser updates, troubleshooting tools, or security utilities offered through captive portals. * **Exercise Caution**: Be highly suspicious of any prompts for software installations or command executions when using public Wi-Fi. This campaign underscores the critical importance of secure network practices, especially when operating in potentially compromised environments like public Wi-Fi networks.