Hotel Wi-Fi Hijacked for Spyware in Midnight Blizzard Campaign

Microsoft disclosed on July 31, 2026, that a Russian state-linked threat cluster has been hijacking hotel Wi-Fi captive portals since May 2026 to serve fake browser and operating system updates that install a full-featured surveillance trojan on the devices of corporate travelers.

The operation, which Microsoft tracks as CaptiveCrunch, is attributed to Storm-2945, assessed as an operational sub-cluster of Midnight Blizzard — the threat actor tied to Russia’s Foreign Intelligence Service (SVR), also known as APT29 and Cozy Bear. The campaign remains active, with no patch available for the underlying attack surface: public Wi-Fi infrastructure.

How CaptiveCrunch Works

Attackers compromise the captive portal systems of hotels, conference centers, and airports. The portals, which normally intercept unauthenticated guests and redirect them to a sign-in page, are repurposed as DNS resolvers under attacker control. When a traveler connects and attempts to browse, DNS poisoning redirects traffic to actor-controlled infrastructure.

The landing pages present ClickFix-style social engineering: convincing imitations of Windows Update prompts, Microsoft Defender scan dialogs, DirectX installers, Visual C++ redistributable pages, disk optimization tools, and browser update notices. The same lure family appears in the GRU-linked campaign where UAC-0145 used fake CAPTCHAs to get Ukrainian targets to paste PowerShell, which is what makes ClickFix a cross-actor delivery pattern rather than one group’s tradecraft. A user who clicks through receives one of two malware payloads.

Microsoft noted that beginning July 16, 2026, some landing pages also integrated Microsoft device code authentication flows, a technique the group has used since at least February 2026, to harvest Microsoft 365 and Azure Active Directory tokens in addition to — or instead of — installing malware.

The Malware: CornFlake and ChocoShell

CornFlake is a Go-based remote access trojan (RAT) with broad surveillance capability. On execution it copies itself to %APPDATA%\svchost32\svchost32.exe, registers a Windows service named “Cloud Sync Service,” creates Registry Run keys and scheduled tasks, and starts a watchdog routine that reinstalls it if removed.

Operator tasking covers:

• Webcam image capture and microphone audio recording via Windows WASAPI and Media Foundation
• Keystroke logging and clipboard monitoring with active window context
• Screenshot capture and file exfiltration categorized by extension
• Browser credential theft from Chrome, Edge, Brave, and Firefox — bypassing Chrome’s App-Bound Encryption (ABE) by impersonating a SYSTEM token
• Removable media scanning
• Remote shell access

Command-and-control communications use ECDH P-256 key exchange with SHA-256 session derivation over a custom JSON protocol. Each session uses a unique ephemeral key pair.

ChocoShell is an in-memory PowerShell stealer deployed alongside or instead of CornFlake in some intrusions. Its priority target is cloud authentication tokens: it extracts Microsoft 365 SSO access and refresh tokens, Web Account Manager (WAM) tokens stored in .tbres files from the Token Broker cache, browser cookies, and saved passwords. It also harvests Wi-Fi credentials via netsh commands.

ChocoShell evades endpoint defenses by bypassing AMSI through .NET reflection, timing sandbox detection, and masking C2 traffic as image pixel requests to /t/pixel.gif?m=<status> and JavaScript polyfill fetches to /cdn/chunks/polyfill-7e2b.min.js. Exfiltrated data is GZip-compressed and Base64-wrapped before transmission. The stealer attempts UAC bypass through a three-method fallback: SilentCleanup task hijack, wsreset.exe COM handler hijacking, and sdclt.exe folder hijack.

Both tools are managed through FruitStone, a web-based C2 panel masquerading as “CloudSync Console” by a fictitious vendor. It provides JWT-authenticated multi-operator access, a real-time agent dashboard with geographic mapping, file browsing, collection tasking, and a campaign builder wizard for configuring which fake update lure to display.

Scope and Attribution

Microsoft did not name specific hotel brands or venues. The advisory states that “common equipment or management systems across affected networks” suggest a possible compromise of a shared hospitality services provider, though this was not confirmed. Targets are corporate travelers — people whose devices carry enterprise credentials, M365 sessions, and access to internal systems.

ReliaQuest published an independent disclosure on July 23, 2026, eight days before Microsoft’s advisory.

The SVR attribution follows an established pattern. Midnight Blizzard has previously conducted supply-chain compromises (SolarWinds, 2020), targeted Microsoft’s own corporate email environment (disclosed January 2024), and repeatedly used device code phishing against government and enterprise targets. CaptiveCrunch extends those credential-theft goals into the physical hospitality layer. Campaigns at this tempo depend on hosting that survives takedown attempts, which is what the Dutch seizure of 800 servers was aimed at and why prosecutors went after the facilitators rather than the sanctioned entity. Bulletproof hosting: why takedowns keep failing sets out how quickly that capacity has historically been replaced.

Indicators of Compromise

Microsoft published the following IOCs in its July 31 advisory:

Domains:

• ms365-device[.]com
• ms365-live[.]com
• m365-owa[.]com
• owa-ms365[.]com

IP addresses:

• 31.57.243.154
• 38.146.28.75
• 38.146.28.132
• 104.194.159.150
• 107.189.26.194
• 213.145.86.112

File hashes (SHA-256):

• CornFlake: 918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593
• ChocoShell: be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c

Advanced hunting queries covering post-NCSI file creation, Storm-2945 infrastructure connectivity, CornFlake service registration, and ChocoShell C2 patterns are included in the Microsoft advisory.

What Defenders Should Do

1. Block device code flow in Azure AD Conditional Access except where it is operationally required. Implement policies that flag or deny risky sign-ins from unfamiliar network locations.
2. Push travel security guidance before employee travel: avoid installing anything from a captive portal, use a mobile hotspot or enterprise travel router instead of hotel Wi-Fi, and never enter corporate credentials on a network that triggers update prompts.
3. Deploy the published IOCs — domains and IPs — to DNS sinkholes, firewall block lists, and SIEM detection rules within 24 hours.
4. Hunt for CornFlake persistence markers: %APPDATA%\svchost32\svchost32.exe, the “Cloud Sync Service” service name, and associated Run keys and scheduled tasks.
5. Review Microsoft 365 risky sign-in reports for accounts whose last successful authentication originated from a hospitality network. Revoke refresh tokens for any flagged accounts and force reauthentication through a trusted device.

Microsoft Defender for Endpoint detections covering AMSI tampering, OAuth device code abuse, UAC bypass, and browser credential theft are listed in the advisory for organizations using that platform.