Hijacked Hotel Wi-Fi Pushes Fake Updates to Deliver Surveillance Malware
Hijacked hotel Wi-Fi delivers surveillance malware via fake updates.
A sophisticated operation dubbed CaptiveCrunch, attributed to Storm-2945 (a sub-cluster of Midnight Blizzard/APT29), is hijacking hotel Wi-Fi networks to push fake browser updates. These updates deliver CornFlake, a Go-based RAT capable of capturing sensitive data and credentials, and ChocoShell, a PowerShell stealer targeting Microsoft 365 and Azure AD tokens. The attackers exploit captive portal gateways to redirect users to malicious sites, and in some cases, leverage Microsoft's device code authentication flow for MFA-satisfied access.
AI summary of the linked source. Not reviewed by an editor. How this works
The lesson from this incident
Full lessonThe CaptiveCrunch campaign exploits a fundamental trust gap: users on unfamiliar hotel networks are conditioned to accept captive portal prompts, making them susceptible to fake browser update lures. By abusing Microsoft's device code authentication flow, attackers can bypass MFA entirely, meaning even well-configured accounts are at risk once a user interacts with a malicious page. The delivered malware — CornFlake and ChocoShell — specifically targets Microsoft 365 and Azure AD tokens, giving attackers persistent, privileged cloud access long after the initial compromise. This attack matters because it targets high-value individuals (executives, diplomats, government personnel) in transient, low-trust network environments where vigilance is naturally reduced.
What helps against this
How we list vendors
- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- DNS filtering and secure web gateway
Users cannot reach known-malicious sites, and malware cannot phone home.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — CornFlake
- malware — ChocoShell
- mitre_attack — T1059.001
- mitre_attack — T1071.001
- mitre_attack — T1553.005
- mitre_attack — T1056.001
- mitre_attack — T1113
- mitre_attack — T1115
- mitre_attack — T1555.003
- mitre_attack — T1003.005
- mitre_attack — T1071.004
- mitre_attack — T1539
- mitre_attack — T1078.004
- mitre_attack — T1078.002
- mitre_attack — T1078.003