Hotel Wi-Fi attacks use custom malware to breach Microsoft 365 accounts

Summary

Microsoft has attributed a global campaign, dubbed CaptiveCrunch, to the Russian threat actor Midnight Blizzard (APT29). The campaign leverages compromised hotel Wi-Fi networks to steal Microsoft 365 credentials through DNS manipulation and phishing pages. Two new malware families, CornFlake (a RAT) and ChocoShell (a PowerShell credential stealer), were identified, along with a management panel named FruitStone.

Full text

Hotel Wi-Fi attacks use custom malware to breach Microsoft 365 accounts By Bill Toulas August 3, 2026 08:17 PM 0 Microsoft has linked a global campaign targeting hospitality Wi-Fi networks to the Russian threat actor Midnight Blizzard, also known as APT29. The activity was previously disclosed in a report from cybersecurity company ReliaQuest, which detailed how the attacker changed DNS settings on Wi-Fi devices to steal Microsoft 365 accounts. Besides attributing the campaign to Russian hackers tracked as Storm-2945 - a sub-cluster of Midnight Blizzard, Microsoft identified two malware families called CornFlake and ChocoShell with capabilities for persistent access, credential theft, surveillance, and data exfiltration. Microsoft named the campaign CaptiveCrunch and believes it has been active since at least early May, although the threat actor has been running device and OAuth code phishing operations since February. Attack chain The attackers manipulate DNS and HTTP traffic on networks served by captive portal equipment, allowing them to intercept user connections to hotel and conference center Wi-Fi networks. Like ReliaQuest, Microsoft was unable to determine the exact initial compromise, although it noted signs of breaches in shared infrastructure rather than isolated devices. After modifying DNS settings, the attacker can redirect victims to phishing pages that impersonate Microsoft 365 login portals, or to device code phishing pages that abuse Microsoft Entra ID authentication flows. Microsoft observed this activity since July. A third option not previously disclosed involves using fake browser and operating system update pages that deliver malware to Windows via ClickFix prompts for user verification. ClickFix prompt in CaptiveCrunch campaignsource: Microsoft Microsoft also found evidence in some ClickFix landings indicating that the threat actor is also targeting Android devices to deliver an APK file. CornFlake and ChocoShell malware Microsoft analyzed the two new Windows malware families and found that CornFlake is a Go-based remote access trojan (RAT) that offers the following capabilities: Remote shell access Keylogging Clipboard monitoring Screenshot capturing Microphone and webcam surveillance Browser credential and cookie theft Microsoft 365 session token theft File exfiltration USB monitoring System reconnaissance When executed, CornFlake shows a fake progress window to distract the user while the binary copies to %AppData% for persistence. According to the researchers, the bogus window can be configured to appear as a Windows update screen, a Defender virus scan, a disk optimization utility, a network diagnostics tool, a browser update prompt, or a document viewer installer. Fake Windows updateSource: Microsoft CornFlake disguises itself as “Cloud Sync Service” to appear as a legitimate Windows component, and uses multiple persistence mechanisms on the host, including Windows service registrations, registry run keys, named tasks, and a watchdog routine designed to restore any of the available persistence mechanisms. The second payload, ChocoShell, is an in-memory PowerShell credential stealer that targets browser cookies, saved passwords, Microsoft 365 and Azure AD tokens, and Wi-Fi credentials. Overview of the attack chainSource: Microsoft Based on the extensive comments in the code, Microsoft assesses that AI tools were likely used to develop the two pieces of malware. The researchers also discovered an unprotected web-based management panel named FruitStone that the threat actor used to handle infected systems, browse victim files, execute PowerShell commands, and capture screenshots and keystrokes. Microsoft recommends treating hotel and conference Wi-Fi as untrusted, using private cellular or managed connections whenever possible, and avoiding software updates or tools offered through captive portals. It is also recommended to adopt phishing-resistant authentication with MFA and passkeys, disable Microsoft Entra device code authentication when not needed, and avoid using corporate credentials to register for guest Wi-Fi networks. Test every layer before attackers do Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection. Get the whitepaper Related Articles: Hackers hijack hotel Wi-Fi DNS to steal Microsoft 365 accountsNew Forg365 phishing platform uses AI to target Microsoft 365 accountsEntra passkey enrollment vishing targets Microsoft 365 usersConsentFix and ClickFix: How Microsoft 365 Accounts are Hijacked in 3 SecondsNew Pass-ta-key attacks let malware hijack Google-synced passkeys

Indicators of Compromise

• mitre_attack — T1566.002
• mitre_attack — T1071.001
• mitre_attack — T1071.004
• mitre_attack — T1110.004
• mitre_attack — T1056.001
• mitre_attack — T1113
• mitre_attack — T1115
• mitre_attack — T1059.001
• malware — CornFlake
• malware — ChocoShell

Entities