THREATNOIR
Subscribe
Back to advisories

Russian State APT Linked to Recent Public Wi-Fi Gateway Hacking

Russian state APT Storm-2945 is compromising public Wi-Fi gateways at hotels and conferences to steal Microsoft 365 credentials from traveling employees. Victims are redirected through DNS/HTTP manipulation attacks and served malware disguised as browser updates. This is an active campaign targeting our mobile workforce with no known CVEs.

CRITICALAdvisoryAug 04, 2026
Action required
Hunt for suspicious device code authentication attempts and browser update prompts on corporate endpoints that connected to public Wi-Fi in the last 30 days. Block known CornFlake and ChocoShell C2 domains and monitor for lateral movement from compromised M365 accounts.
Affected products
Microsoft
Linked articles
Source links