Russian state hackers have spent the past three months taking over the Wi-Fi sign-in pages that business travelers use in hotels and conference venues, then using that position to push malware onto their laptops and steal the tokens that unlock corporate email. The campaign, called CaptiveCrunch, was detailed on July 31 by Microsoft Threat Intelligence.
Microsoft attributes the operation to Storm-2945, a cluster it assesses to be an operational sub-group of Midnight Blizzard. Midnight Blizzard, better known as APT29 or Cozy Bear, has been attributed by the US and UK governments to Russia's Foreign Intelligence Service (SVR), and it has historically gone after governments, diplomatic missions, NGOs and IT service providers in the US and Europe.
What's affected
Since early May 2026, Microsoft says Storm-2945 has been manipulating DNS and HTTP traffic on networks served by captive portals, the sign-in screens that appear when you join a public network. Microsoft reports widespread compromise of Wi-Fi at hospitality organizations and other venues in several countries. ReliaQuest, which published on part of the same activity on July 23, found it not only at hotels but at conference centers and other shared venues, and assesses that the goal is to reach the accounts of corporate travelers.
How the portals themselves were breached is still under investigation, but Microsoft notes recurring commonalities in the equipment and management systems across affected networks, which it says could point to access to shared services within part of the captive portal ecosystem rather than isolated break-ins at individual venues.
How the attack works
Sitting in the middle of the traffic, the operators redirect users to phishing pages on lookalike domains imitating Microsoft services. That phishing abuses the device code sign-in flow in Microsoft Entra ID, a legitimate feature for signing in on devices without a keyboard that an attacker can turn into a way to get the victim to approve the attacker's session. Microsoft has tracked Storm-2945 running device code and OAuth code phishing since February 2026, registering their own devices in the victim's tenant and then collecting Microsoft 365 data.
The same position is used to deliver malware. When a browser makes its routine connectivity check, the attackers answer with a fake browser or operating system update and walk the user through running it with ClickFix style instructions. The main implant, CornFlake, is a Go based Windows remote access trojan that shows a convincing fake update window while installing itself as a service named svchost32 with the display name "Cloud Sync Service". It logs keystrokes, captures the clipboard and screen, records microphone and webcam, steals browser cookies and saved passwords, watches for USB drives and gives the operator a remote shell.
A second tool, ChocoShell, runs entirely in memory in PowerShell and goes after the credentials that matter most: browser session cookies, saved passwords, Wi-Fi keys, and Microsoft 365 and Azure Active Directory access, refresh and Web Account Manager tokens lifted from the Token Broker cache. Those tokens let an operator replay a signed in session without the password or the cookie. Microsoft says the script's developer comments, which name specific Microsoft detection signatures, suggest it was written with AI assistance, and that the actor leveraged AI to support a significant portion of these operations. Microsoft thanked Anthropic and OpenAI for their collaboration during the investigation. ClickFix landing pages also offered an APK download, an indication the crew may be aiming at Android devices as well.
What you should do
For travelers the practical rule is to treat venue Wi-Fi as hostile: never accept a browser or operating system update prompt that appears after joining a network, and install updates only through the vendor's own updater. Microsoft points administrators to the Windows MDM policy that blocks manual Wi-Fi configuration. Security teams should review Entra ID for unexpected device registrations and revoke refresh tokens for any traveler suspected of being caught, because tooling that steals session tokens rather than passwords survives a password reset; the sessions themselves have to be revoked. Phishing that defeats multi-factor authentication is now the most common way intrusions begin, as we covered in Cisco Talos's latest incident response data, and this group's device code tradecraft also showed up in a watering hole campaign Amazon disrupted earlier this year.
Indicators
Selected defanged indicators published by Microsoft:
- ChocoShell command and control: 213[.]145[.]86[.]112, with beacons to hxxps://213[.]145[.]86[.]112/t/pixel[.]gif and exfiltration by POST to /t/event
- Additional actor IP addresses: 31[.]57[.]243[.]154, 38[.]146[.]28[.]75, 38[.]146[.]28[.]132, 104[.]194[.]159[.]150, 107[.]189[.]26[.]194
- File hashes (SHA-256): 918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593 and be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c
- CornFlake install path %APPDATA%\svchost32\svchost32.exe, service name svchost32
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.