APT29 Exploits Hotel Wi-Fi to Steal Microsoft 365 Credentials
Written by AI from the linked story. Not reviewed by an editor. How this works
The CaptiveCrunch campaign demonstrates how nation-state actors abuse trusted but insecure public Wi-Fi infrastructure to intercept credentials through DNS manipulation and convincing phishing pages. By compromising hotel networks — environments users implicitly trust — Midnight Blizzard bypassed perimeter defenses and targeted credentials at the point of entry. The deployment of custom malware (CornFlake RAT and ChocoShell) alongside a management panel signals a mature, persistent operation rather than an opportunistic attack. This matters because Microsoft 365 credentials provide broad access to organizational data, email, and cloud resources, making them high-value targets with cascading breach potential.
Tactical Insight
Immediate actions
- Enforce phishing-resistant MFA (FIDO2/hardware keys) on all Microsoft 365 accounts to render stolen passwords alone insufficient.
- Deploy Conditional Access policies that block or challenge authentications from untrusted or unfamiliar network locations.
- Remind staff never to access corporate resources over public or hotel Wi-Fi without an approved corporate VPN.
Long-term improvements
- Implement a Zero Trust Network Access (ZTNA) model so that network location is never treated as implicit trust.
- Adopt DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT) on managed endpoints to prevent DNS hijacking on untrusted networks.
- Maintain a device compliance posture requiring endpoint health checks before granting access to cloud resources.
Detection measures
- Enable Microsoft Entra ID (Azure AD) sign-in risk policies and Identity Protection to flag anomalous authentication patterns and impossible travel events.
- Monitor for PowerShell execution anomalies and unauthorized RAT-like network beaconing using endpoint detection and response (EDR) tooling.
- Correlate DNS query logs with threat intelligence feeds to identify connections to known APT29 infrastructure.