What Microsoft found
Microsoft disclosed on August 1, 2026 that it has been tracking a cyber espionage campaign, internally named CaptiveCrunch, that hijacks hotel Wi-Fi networks to plant surveillance malware on travelers' devices. The company said it first observed traffic manipulation consistent with the campaign in early May 2026, meaning the operation ran for close to three months before public disclosure. Microsoft declined to name specific hotels, venues, or captive portal vendors affected, citing ongoing investigation and victim notification. The disclosure came bundled with detection guidance and indicators of compromise for enterprise security teams, an unusual level of technical detail for a live nation-state campaign, suggesting Microsoft judged the risk to traveling customers high enough to warrant disclosure before the investigation had fully run its course. The company said the geographic spread of affected properties covers multiple countries, and that it continues to observe new instances of the traffic manipulation pattern as of the disclosure date, meaning the campaign was still active rather than a closed, historical incident.
The campaign is attributed to Storm-2945, which Microsoft assesses as an operational sub-cluster of Midnight Blizzard, the threat actor the U.S. and U.K. governments have publicly tied to Russia's Foreign Intelligence Service, the SVR. Separately, threat intelligence firm ReliaQuest documented overlapping infrastructure and tradecraft that also resembles APT28, also known as Fancy Bear or Forest Blizzard, though it stopped short of formal attribution to that group.
How the attack chain works
The entry point is the hotel's Wi-Fi gateway itself, not the victim's device. ReliaQuest assesses with low-to-medium confidence that attackers gained access through exposed management interfaces protected by weak or reused administrator credentials, though it could not confirm the exact initial access vector due to visibility limits. Once inside the gateway, attackers configure it to serve as a malicious DNS resolver, allowing them to forge DNS responses for any domain a connected guest tries to reach.
Guests are redirected to convincing fake browser or operating system update pages. Some of these use ClickFix-style social engineering, instructing the victim to open a terminal or another Windows utility and manually run an attacker-supplied command, rather than delivering a silent drive-by install. That manual step means the malware only lands if the victim is tricked into executing it themselves, but the campaign's multi-month run suggests the lure is working well enough to sustain it.
CornFlake and ChocoShell: what gets installed
The primary payload is CornFlake, a Go-based remote access trojan. It installs itself to %APPDATA%\svchost32\svchost32.exe, a filename chosen to blend in with legitimate Windows processes, and registers as a fake Cloud Sync Service using a Registry Run key and scheduled tasks for persistence, backed by a watchdog process that restores the implant if a defender removes it. Its capabilities include idle-triggered screenshots, clipboard monitoring with the active window title attached for context, theft of browser cookies and passwords including Chrome's App-Bound Encryption-protected cookies, removable media scanning, and a full remote shell.
In some intrusions, attackers also dropped ChocoShell, a PowerShell-based stealer built specifically to harvest Microsoft 365, Azure AD, and Web Account Manager tokens from the Windows Token Broker cache. Since July 16, 2026, some of the fake update pages have redirected victims into Microsoft's device code authentication flow, a legitimate feature meant for input-constrained devices. By walking the victim through entering a code themselves, attackers obtain a fully authenticated, MFA-satisfied session token for the victim's cloud identity without ever touching a password.
Why business travelers are the target
Hotel Wi-Fi has always been a soft spot in enterprise security models built around office and home network trust. CaptiveCrunch exploits that gap precisely: it doesn't need to compromise a specific target's laptop directly, only the shared network infrastructure a target is likely to use at some point during travel. Executives, sales teams, and remote employees who connect to hotel networks for convenience become collateral in a much broader collection operation, and the device code phishing angle is particularly dangerous because it defeats MFA using a mechanism most security awareness training doesn't cover. Unlike a typical phishing email, which a well-trained employee might flag on sight, a captive portal update prompt looks like exactly what it claims to be, a routine step between connecting to Wi-Fi and getting online, which is precisely why it works.
The espionage motive, combined with the token theft capability against Microsoft 365 and Azure AD, points toward intelligence collection against corporate and government travelers rather than opportunistic financial crime. That profile matches Midnight Blizzard's historical targeting of diplomatic, government, and enterprise cloud identities, and it lines up with the group's prior operations against Microsoft's own corporate email systems and against Western government and defense contractor accounts, where the objective has consistently been long-term, quiet access rather than immediate monetization.
What enterprise security teams should do
Microsoft's core recommendation is to treat every hotel, airport, and public Wi-Fi network as hostile by default. That means mandating an always-on, full-tunnel VPN configured to use corporate DNS resolvers for any employee connecting from hospitality or public networks, so a compromised local gateway can't forge DNS responses that reach the endpoint. Employees should also be trained explicitly to reject any software update, driver install, or certificate prompt that originates from a captive portal or public Wi-Fi login page.
On the identity side, security teams should use Conditional Access policies to block Microsoft's device code authentication flow entirely unless a specific, documented business need requires it, since that flow is precisely what CaptiveCrunch is abusing to bypass MFA. Given the three-month dwell time before this campaign came to light, organizations with frequent business travelers should also review recent sign-in logs for anomalous device code grants and unexpected Token Broker activity as part of incident response triage.
