[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fn_4ezDBtdHqlWRUO0uVu0qGRChL9yQi8d7Kzo_PiFPQ":3},{"article":4,"iocs":53,"watch_terms":100,"solutions":101,"lesson":199},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"ebe4279a-385e-41f1-bffa-425d5f9e4d94","Hijacked Hotel Wi-Fi Pushes Fake Updates to Deliver Surveillance Malware","hijacked-hotel-wi-fi-pushes-fake-updates-to-deliver-surveillance-malware-ef832f","A fake browser update served over hijacked hotel Wi-Fi has been used to deliver CornFlake, a remote access trojan (RAT) that can capture webcam images, microphone audio, and keystrokes, Microsoft said in its latest report. Researchers track the operation as CaptiveCrunch and attribute it to Storm-2945. It assesses Storm-2945 to be an operational sub-cluster of Midnight Blizzard, also known as","A sophisticated operation dubbed CaptiveCrunch, attributed to Storm-2945 (a sub-cluster of Midnight Blizzard\u002FAPT29), is hijacking hotel Wi-Fi networks to push fake browser updates. These updates deliver CornFlake, a Go-based RAT capable of capturing sensitive data and credentials, and ChocoShell, a PowerShell stealer targeting Microsoft 365 and Azure AD tokens. The attackers exploit captive portal gateways to redirect users to malicious sites, and in some cases, leverage Microsoft's device code authentication flow for MFA-satisfied access.","Hijacked hotel Wi-Fi delivers surveillance malware via fake updates.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002Fhijacked-hotel-wi-fi-pushes-fake.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEglJ30Q0_3tS3R4yrNdyR3sDdvBam1plVfmenBAFVPGmaVMErJ_oq_zXoIpeAjrFrkkFkudKUSHI-h82FGoiIJlkT2JghjQKrO2p7VmzpduPGv26gGgJ8I04b-U7eY1sihmIer0bGTtIof3CwH1vKmQOYLDvhNsYICoALOLhehhaLC65fPmAH_fpT0BrKk\u002Fs1600\u002Fhotel-wifi.jpg","2026-08-01T06:29:05+00:00","2026-08-01T08:00:05.462663+00:00",9,[17,20,22,24,26,28],{"name":18,"type":19},"Storm-2945","threat_actor",{"name":21,"type":19},"Midnight Blizzard",{"name":23,"type":19},"APT29",{"name":25,"type":19},"Cozy Bear",{"name":27,"type":19},"APT28",{"name":29,"type":19},"Fancy Bear","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":30,"icon":32,"name":33,"slug":34},null,"Nation-state","nation-state",[36,41,43,48],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":42},{"id":30,"icon":32,"name":33,"slug":34},{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54,57,60,64,67,70,73,76,79,82,85,88,91,94,97],{"type":47,"value":55,"context":56},"CornFlake","Remote Access Trojan (RAT) used in the campaign.",{"type":47,"value":58,"context":59},"ChocoShell","In-memory PowerShell stealer used in the campaign.",{"type":61,"value":62,"context":63},"mitre_attack","T1059.001","Command and Scripting Interpreter: PowerShell (used by ChocoShell).",{"type":61,"value":65,"context":66},"T1071.001","Application Layer Protocol: Web Protocols (used for redirection).",{"type":61,"value":68,"context":69},"T1553.005","Subvert Trust Controls: Mark-of-the-Web Bypass (implied by fake updates).",{"type":61,"value":71,"context":72},"T1056.001","Input Capture: Keylogging (capability of CornFlake).",{"type":61,"value":74,"context":75},"T1113","Screen Capture (capability of CornFlake).",{"type":61,"value":77,"context":78},"T1115","Clipboard Data (capability of CornFlake).",{"type":61,"value":80,"context":81},"T1555.003","Credentials from Password Stores: Browser Stored Data (capability of CornFlake).",{"type":61,"value":83,"context":84},"T1003.005","OS Credential Dumping: Web Accounts (targeted by ChocoShell).",{"type":61,"value":86,"context":87},"T1071.004","Application Layer Protocol: DNS (used for redirection).",{"type":61,"value":89,"context":90},"T1539","Steal Web Session Cookie (capability of CornFlake).",{"type":61,"value":92,"context":93},"T1078.004","Valid Accounts: Cloud Accounts (targeted by ChocoShell).",{"type":61,"value":95,"context":96},"T1078.002","Valid Accounts: Domain Accounts (implied by token theft).",{"type":61,"value":98,"context":99},"T1078.003","Valid Accounts: Local Accounts (implied by persistence).",[],{"controls":102,"vendors":190},[103,132,161],{"slug":104,"name":105,"problem":106,"products":107},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[108,116,124],{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":133,"name":134,"problem":135,"products":136},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[137,145,153],{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":146,"vendor_name":147,"vendor_logo":148,"product_slug":149,"product_name":150,"url":151,"description":152},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":154,"vendor_name":155,"vendor_logo":156,"product_slug":157,"product_name":158,"url":159,"description":160},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"slug":162,"name":163,"problem":164,"products":165},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[166,174,182],{"vendor_slug":167,"vendor_name":168,"vendor_logo":169,"product_slug":170,"product_name":171,"url":172,"description":173},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-gateway","Cloudflare Gateway","https:\u002F\u002Fwww.cloudflare.com\u002Fproducts\u002Fgateway\u002F","DNS filtering and secure web gateway.",{"vendor_slug":175,"vendor_name":176,"vendor_logo":177,"product_slug":178,"product_name":179,"url":180,"description":181},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","umbrella","Cisco Umbrella","https:\u002F\u002Fumbrella.cisco.com\u002F","DNS-layer security and secure web gateway delivered from the cloud.",{"vendor_slug":183,"vendor_name":184,"vendor_logo":185,"product_slug":186,"product_name":187,"url":188,"description":189},"zscaler","Zscaler","\u002Fvendor-logos\u002Fzscaler.png","zscaler-internet-access","Zscaler Internet Access","https:\u002F\u002Fwww.zscaler.com\u002Fproducts-and-solutions\u002Fzscaler-internet-access","Cloud secure web gateway with DNS security, inspection and data protection.",[191,194],{"slug":117,"name":118,"logo_path":119,"roles":192},[193],"reported_by",{"slug":195,"name":196,"logo_path":197,"roles":198},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png",[193],{"slug":200,"title":201,"body":202,"framework_refs":203,"framework_notes":218},"apt29-hijacks-hotel-wi-fi-to-deliver-fake-updates-and-steal-credentials","APT29 Hijacks Hotel Wi-Fi to Deliver Fake Updates and Steal Credentials","The CaptiveCrunch campaign exploits a fundamental trust gap: users on unfamiliar hotel networks are conditioned to accept captive portal prompts, making them susceptible to fake browser update lures. By abusing Microsoft's device code authentication flow, attackers can bypass MFA entirely, meaning even well-configured accounts are at risk once a user interacts with a malicious page. The delivered malware — CornFlake and ChocoShell — specifically targets Microsoft 365 and Azure AD tokens, giving attackers persistent, privileged cloud access long after the initial compromise. This attack matters because it targets high-value individuals (executives, diplomats, government personnel) in transient, low-trust network environments where vigilance is naturally reduced.",[204,205,206,207,208,209,210,211,212,213,214,215,216,217],"CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 6: Access Control Management","CIS Control 9: Email and Web Browser Protections","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-207: Zero Trust Architecture","NIST AC-17: Remote Access","NIST AC-20: Use of External Systems","NIST IA-2(6): Phishing-Resistant MFA","NIST SI-3: Malicious Code Protection","NIST AU-12: Audit Record Generation","MITRE ATT&CK T1566: Phishing (User Execution - Malicious Link)","MITRE ATT&CK T1550.001: Use Alternate Authentication Material (Application Access Token)","MITRE ATT&CK T1528: Steal Application Access Token","GDPR Article 32: Security of Processing (for organizations subject to EU data protection law)",{}]