Hotel Wi-Fi attacks use custom malware to breach Microsoft 365 accounts

The CaptiveCrunch campaign demonstrates how nation-state actors abuse trusted but insecure public Wi-Fi infrastructure to intercept credentials through DNS manipulation and convincing phishing pages. By compromising hotel networks — environments users implicitly trust — Midnight Blizzard bypassed perimeter defenses and targeted credentials at the point of entry. The deployment of custom malware (CornFlake RAT and ChocoShell) alongside a management panel signals a mature, persistent operation rather than an opportunistic attack. This matters because Microsoft 365 credentials provide broad access to organizational data, email, and cloud resources, making them high-value targets with cascading breach potential.