Russian hackers turn hotel Wi-Fi into a trap for Microsoft 365 logins
Microsoft has attributed the CaptiveCrunch campaign to Storm-2945, a sub-group of APT29, which has been poisoning hotel and conference Wi-Fi networks since at least May 2025 to steal corporate accounts using two newly identified malware families.
Key points
- Microsoft has tied a global attack on hotel and conference Wi-Fi networks to Storm-2945, a sub-group of the Russian state hacking crew known as Midnight Blizzard or APT29.
- The campaign, named CaptiveCrunch, has been running since at least early May 2025 and targets Microsoft 365 accounts.
- Attackers poison the Wi-Fi network's DNS settings so guests trying to reach Microsoft's login page are routed to a fake one instead.
- Two new Windows malware families, CornFlake and ChocoShell, steal passwords, session tokens and Wi-Fi credentials from infected laptops.
- Microsoft says unusually detailed code comments suggest both tools were built with AI assistance.
Russian government hackers have been quietly turning hotel Wi-Fi into a trap for corporate logins, according to new research from Microsoft.
The campaign, which Microsoft calls CaptiveCrunch, is the work of Storm-2945, a sub-cluster of Midnight Blizzard, also known as APT29, the Russian foreign intelligence unit blamed for the SolarWinds breach. We first covered the underlying DNS-hijacking technique on 24 July, when ReliaQuest reported the campaign without a confirmed state attribution. Microsoft has now provided that attribution and named two malware families the earlier report missed.
How does the attack actually work?
Guests connect to hotel Wi-Fi, and the network routes them to fake Microsoft login pages instead of the real ones. The attackers change the network's DNS settings, the address system that translates names like login.microsoftonline.com into a numeric server address. Once poisoned, that address system can send anything a guest types through the attackers first.
Microsoft still doesn't know exactly how the hackers get into the Wi-Fi equipment, but the pattern points to shared infrastructure across multiple venues rather than one-off compromises.
Victims see one of three things. Some get a convincing copy of the Microsoft 365 sign-in page. Others get a device-code prompt, a legitimate Microsoft Entra ID authentication flow that the attackers abuse to hijack a session on their own machine. A third group gets a fake browser or Windows update page using the ClickFix trick, where the page tells the user to paste a command into their computer to "verify" themselves. That command installs malware. Some of those fake update pages also drop an Android app file, so phones are in scope too.
What do CornFlake and ChocoShell do?
They turn an infected laptop into an open book. CornFlake is a remote-access trojan written in Go. It hides behind a fake progress window styled as a Windows Update screen, a Defender scan or a disk-cleanup utility while it copies itself into the user's AppData folder and pins itself to the machine through service registrations, registry run keys, scheduled tasks and a watchdog that restores any persistence mechanism that gets removed. Once running, it can log keystrokes, grab clipboard contents, capture screenshots, activate the microphone or webcam, steal browser credentials and cookies, and lift Microsoft 365 session tokens directly from the browser.
ChocoShell is lighter: an in-memory PowerShell credential stealer targeting saved passwords, browser cookies, Microsoft 365 and Azure AD tokens, and stored Wi-Fi passwords. PowerShell is the scripting engine built into Windows, so no additional software needs to land on disk.
Microsoft assesses that both tools were partly written with AI assistants, based on the unusually detailed code comments. The attackers also run a web management panel called FruitStone to browse victim files and execute commands. Microsoft found it sitting on the open internet, completely unprotected.
Would MFA have helped?
Yes, but only the right kind. Text codes and authenticator-app tokens can still be phished through a fake login page or surrendered during a device-code prompt. Our 31 July piece on device-code phishing laid out exactly why that flow is so dangerous: it was designed for smart TVs, not for environments where an attacker can push an auth prompt to you. Passkeys and hardware security keys, which are bound to the real website's domain, would stop the credential theft entirely.
What travellers and staff should do
Treat hotel and conference Wi-Fi as hostile. Use a phone hotspot or a company-managed connection for anything work-related. Don't install a software update from a captive portal, and don't paste a command into your terminal because a webpage told you to. Avoid using your work email to register for guest Wi-Fi. Microsoft also recommends disabling Microsoft Entra device-code authentication for users who don't need it, which removes one of the three attack paths entirely.
