Russian hackers turn hotel Wi-Fi into a trap for Microsoft 365 logins
Microsoft says APT29 sub-group Storm-2945 has been hijacking guest Wi-Fi at hotels and conference centres since May, planting two new malware families to steal corporate accounts.
Key points
- Microsoft has tied a global attack on hotel and conference Wi-Fi networks to Storm-2945, a sub-group of the Russian state hacking crew known as Midnight Blizzard or APT29.
- The campaign, named CaptiveCrunch, has been running since at least early May 2025 and targets Microsoft 365 accounts.
- Attackers tamper with the Wi-Fi network's address book so guests trying to reach Microsoft's login page are sent to a fake one instead.
- Two new pieces of Windows malware, CornFlake and ChocoShell, steal passwords, session tokens and Wi-Fi credentials from infected laptops.
- Microsoft says code comments suggest the malware was built with the help of AI tools.
Russian government hackers have been quietly turning hotel Wi-Fi into a fishing net for corporate logins, according to fresh research from Microsoft.
The campaign, which Microsoft calls CaptiveCrunch, is the work of a group it tracks as Storm-2945. That group is part of Midnight Blizzard, also known as APT29, the same Russian foreign intelligence unit blamed for the SolarWinds break-in five years ago.
The activity was first reported by BleepingComputer citing earlier research from security firm ReliaQuest. Microsoft has now added the state attribution and named two new malware families used in the attacks.
How does the attack actually work?
Guests connect to hotel Wi-Fi, and the network silently sends them to fake Microsoft login pages instead of the real ones. The attackers have quietly changed the network's DNS settings, which is the internet's address book that turns names like login.microsoftonline.com into the numeric address of the real server.
Once that address book is poisoned, anything a guest types can be routed through the attackers first.
Microsoft says it still does not know exactly how the hackers get into the Wi-Fi equipment in the first place, but the pattern points to shared kit used across multiple venues rather than one-off hacks.
From there, victims see one of three things. Some get a convincing copy of the Microsoft 365 sign-in page. Others get a "device code" prompt, a legitimate Microsoft Entra ID login flow that the attackers abuse to hijack a session on their own machine. A third group gets a fake browser or Windows update page using the ClickFix trick, where the site tells the user to paste a command into their computer to "verify" themselves. That command installs malware.
Some of those fake update pages also drop an Android app file, suggesting phones are on the target list too.
What do CornFlake and ChocoShell do?
They turn an infected laptop into an open book for the attackers. CornFlake is a remote-access tool written in the Go programming language. ChocoShell is a lighter password-stealer that runs in memory using PowerShell, a scripting tool built into Windows.
CornFlake hides behind a fake progress window (Windows Update, Defender scan, disk cleanup) while it copies itself into the user's AppData folder and pins itself to the machine with several persistence tricks. Once running, it can log keystrokes, grab clipboard contents, take screenshots, switch on the microphone and webcam, steal browser cookies and passwords, and lift Microsoft 365 session tokens straight from the browser.
ChocoShell focuses on the credentials themselves: saved passwords, browser cookies, Microsoft 365 and Azure AD tokens, and stored Wi-Fi passwords.
Microsoft's analysts think both tools were partly written with AI assistants, based on the unusually chatty code comments. The hackers also run a web dashboard called FruitStone to browse victim files and fire off commands, and Microsoft found it sitting on the open internet with no login.
Would MFA have helped?
Yes, but only the right kind. Traditional codes sent by text or from an authenticator app can still be phished through a fake login page or handed over during a device-code prompt. Passkeys and hardware security keys, which are tied to the real website's address, would have stopped the login theft cold. This is exactly the scenario RFC 8628 warned about when device code flows were standardised: convenient for smart TVs, dangerous when a stranger can push the prompt to you.
What travellers and staff should do
Treat hotel and conference Wi-Fi as hostile. Use a phone hotspot or a company-managed connection for anything work-related. Never install a software update offered by a Wi-Fi captive portal. Never paste a command into your terminal or Run box because a webpage told you to. And do not use your work email to sign up for guest Wi-Fi.
