Hotel Wi-Fi Hijacks Force a Hard Look at Guest Networks

Microsoft Threat Intelligence has tied a months-long campaign of hotel and conference Wi-Fi hijacks to Storm-2945, a sub-cluster of the Russian SVR-linked group Midnight Blizzard. Since early May 2026 the operators have manipulated traffic on captive-portal networks to steal Microsoft 365 credentials and plant spyware on travelers’ devices.

The operation, called CaptiveCrunch, expands an earlier wave of router-based DNS tricks and shows how shared guest-network equipment can become a ready-made spy platform for every connected guest.

How Captive Portals Become Spy Platforms

Captive portals are the familiar login or accept-terms pages that hotels and venues force users through before granting internet access. Once Storm-2945 controls the underlying gateway, it poisons DNS and HTTP responses for everyone on that network.

Traffic for legitimate Microsoft domains gets redirected through actor infrastructure. Users land on lookalike pages or fake browser and Windows update screens. ReliaQuest first flagged the pattern in July, noting compromised gateways in multiple U.S. cities plus India and Saudi Arabia.

• Gateway compromise via exposed management interfaces or weak credentials
• DNS response forgery that answers queries for Microsoft services with attacker IPs
• Redirects to doppelganger domains such as m365-owa[.]com and ms365-live[.]com
• ClickFix-style prompts that instruct users to paste commands or download “updates”
• Optional device-code phishing that tricks users into authorizing the attacker’s session on a real Microsoft page

The ReliaQuest hospitality DNS poisoning report stressed that a single compromised appliance puts every guest at risk without any phishing email or malware pre-positioned on endpoints. Microsoft later confirmed the same traffic-manipulation pattern and added the malware delivery stage.

The sequence is efficient because the portal already sits between the user and the open internet. Guests expect a login or terms page. A forged DNS answer or HTTP redirect therefore looks like part of the normal join flow rather than an alert. Once the gateway is owned, every new device that associates becomes a fresh target without further work by the operator.

Doppelganger domains and fake update screens complete the illusion. The user believes the session is still inside Microsoft or Windows infrastructure. That belief is what carries ClickFix paste instructions and optional device-code prompts across the final step from network control to credential or session theft.

CornFlake and ChocoShell Do Different Jobs

Two main implants handle the payload side. CornFlake is a full-featured Go-based remote access trojan built for long-term control. ChocoShell is a PowerShell information stealer focused on rapid credential harvest.

CornFlake drops to %APPDATA%\svchost32\svchost32.exe, registers a fake “Cloud Sync Service,” and encrypts C2 with ephemeral ECDH keys. Fake update windows keep the user watching while it installs. ChocoShell disables AMSI, runs silent UAC bypasses when the user is a local admin, then empties browser stores and Token Broker caches before cleaning up.

The split is deliberate. ChocoShell moves fast, grabs what it can from browsers and token caches, and exits. CornFlake stays behind for screenshots, keylogging with window titles, remote shell, and broader surveillance. Operators can choose speed or endurance depending on the value of the traveler who just connected.

Microsoft also saw Android APK download instructions on some landing pages, suggesting the campaign may be expanding beyond Windows. The operators run the whole thing from FruitStone, a web C2 panel branded as an innocuous “CloudSync Console.”

Branding the panel as a cloud sync console matches the fake service name CornFlake registers on disk. The same cover story spans the implant, the persistence entry, and the operator interface. That consistency reduces the chance a hurried traveler or a light endpoint review will flag the foothold as foreign.

Midnight Blizzard, Not the Earlier Fancy Bear Pattern

ReliaQuest initially noted strong tradecraft overlap with APT28 (Forest Blizzard / Fancy Bear) SOHO-router campaigns that used DNS hijacking for Microsoft 365 theft. Microsoft draws a different line.

In its Microsoft Threat Intelligence CaptiveCrunch analysis, the firm attributes CaptiveCrunch to Storm-2945, an operational sub-cluster of Midnight Blizzard (APT29 / Cozy Bear). The group is assessed by the U.S. and UK governments as Russia’s SVR foreign intelligence service. Shared hallmarks include prior device-code and OAuth phishing, Microsoft Graph email collection, and victimology focused on governments, diplomats, NGOs and IT providers.

The April 2026 Forest Blizzard SOHO router DNS hijacking campaign remains a clear precedent for the gateway-level DNS trick itself. CaptiveCrunch simply moved the same idea onto hospitality captive-portal appliances and added custom malware plus AI-assisted code and social-engineering generation.

The attribution turn matters for defenders who track clusters by tooling alone. DNS forgery on edge gear is a technique, not a signature of one group. Storm-2945 pairs that technique with Midnight Blizzard’s established interest in device-code flows, OAuth abuse, and Graph-based mail collection. The hospitality shift is a change of venue, not a change of mission.

1. April 2026 – Forest Blizzard SOHO router DNS hijacking sets the gateway-level precedent
2. Early May 2026 – CaptiveCrunch activity begins against hospitality captive portals
3. July 2026 – ReliaQuest flags the traffic pattern across U.S. cities, India and Saudi Arabia
4. Later reporting – Microsoft confirms malware delivery, attributes the work to Storm-2945 under Midnight Blizzard

Corporate Travelers Are the Primary Catch

ReliaQuest observed traffic from financial services, professional services, legal, healthcare, energy and retail organizations hitting the compromised gateways. The venues themselves span hotels, conference centers and other shared spaces. Microsoft confirmed widespread compromise of hospitality-related captive-portal networks in several countries.

Any organization that runs captive portals-airports, co-working spaces, universities, healthcare facilities, event venues-presents a similar surface. The attackers appear less interested in the hotel’s own systems than in the high-value Microsoft 365 accounts that walk through the door every day.

Primary targets: traveling corporate employees

Observed industries: finance, legal, healthcare, energy, retail, professional services

Venues: hotels, conference centers, shared captive-portal sites

Geography: multiple U.S. cities, India, Saudi Arabia and additional countries

That victim mix tracks the Midnight Blizzard focus on governments, diplomats, NGOs and IT providers, even when the initial access point is a hotel lobby rather than a ministry network. A traveler from a law firm or energy company still carries the same cloud identity the group has long pursued through other means.

Shared spaces concentrate those identities. A conference center can host finance, legal and healthcare staff on the same gateway in a single afternoon. One compromised appliance therefore samples multiple industries without the operators needing separate lures for each sector.

Travel Advisories Alone Do Not Stop It

Standard advice tells travelers to avoid hotel Wi-Fi or fire up a VPN immediately. That guidance has limits. The captive portal often must be completed before a tunnel can form. Device-code phishing rides legitimate Microsoft endpoints, so a tunnel simply carries a valid OAuth flow. ClickFix relies on the user pasting a command; no network filter intercepts that human step.

A detailed thread by security practitioner @UK_Daniel_Card put the point bluntly:

Every mitigation that starts with “users should avoid…” or “employees must not…” is an admission that you have no control. It is guidance, not architecture.

The account argued that the network is transport, not the core vulnerability, and that the real failures sit in the identity plane and local-admin rights on devices.

Microsoft’s own guidance aligns with the stronger path. Prefer mobile hotspots or managed travel routers when possible. Never install updates or run commands presented by a portal. On the enterprise side the high-leverage moves are identity and device controls.

• Block or tightly restrict device code flow via Conditional Access
• Require compliant or hybrid-joined devices for access
• Deploy phishing-resistant MFA such as passkeys
• Remove standing local administrator rights from standard user accounts
• Enable PowerShell Constrained Language Mode, ASR rules and Tamper Protection
• Disable browser remote-debugging ports by policy

Organizations can block device code flow with Conditional Access in a single policy. That change alone collapses one of the cleanest token-theft paths in the campaign. Removing local admin rights also neutralizes ChocoShell’s silent UAC bypasses and SYSTEM token theft needed for modern Chrome cookie decryption.

Microsoft has leaned harder into AI-assisted detection for campaigns of this sophistication; its own write-ups note collaboration with Anthropic and OpenAI during the investigation and the growing role of Microsoft security AI handling advanced threats. Parallel work on lighter models offers another layer for resource-constrained teams looking at Microsoft cheaper security AI models.

Each control closes a different stage of the same chain. Conditional Access and compliant-device rules blunt token abuse after a redirect. Least privilege and PowerShell hardening blunt what ChocoShell and CornFlake can do once code runs. Phishing-resistant MFA raises the cost of any password or prompt the portal still manages to collect. No single switch ends the campaign, but the stack turns a successful hijack into a short, noisy failure.

Device Code Flows Carry the Session Out

Optional device-code phishing is one of the cleaner exits from a poisoned portal. The user is steered toward a real Microsoft page and asked to authorize a session the attacker already started. Because the final consent happens on legitimate infrastructure, many network controls never see a forged host at the decisive moment.

A VPN does not break that path. The tunnel carries the OAuth exchange intact once the portal has released the client. The weakness is the willingness of the identity platform to issue tokens for a device-code grant that the traveler did not intentionally begin on a trusted device.

That is why a Conditional Access policy that blocks or tightly restricts device code flow is described as high leverage. It does not depend on the traveler noticing a fake update window or refusing a paste prompt. It removes the grant type the operators want to abuse, even when the gateway and the social prompt both succeed.

CornFlake and ChocoShell still matter when users do follow ClickFix-style instructions. The stealer empties browser stores and Token Broker caches; the RAT builds lasting control. Device-code abuse simply offers a parallel route that can yield a usable cloud session without leaving a long-lived binary behind.

Hospitality Gear Repeats the SOHO Pattern

CaptiveCrunch did not invent gateway DNS forgery. It relocated a method already proven against small-office and home routers. Weak management interfaces, slow patch cycles and implicit trust from every client made SOHO gear attractive. The same traits appear on the appliances that greet hotel guests and conference attendees.

Moving the technique onto captive-portal hardware widens the daily catch. A home router may yield one household. A hotel or venue gateway yields a rotating set of corporate travelers from finance, legal, healthcare, energy and retail. The operators inherit that rotation without crafting fresh phishing mail for each victim.

Custom malware and AI-assisted generation of code and social-engineering content raise the ceiling further. The gateway supplies the redirect. CornFlake, ChocoShell, fake update screens and device-code prompts convert the redirect into credentials, tokens or a durable foothold. FruitStone keeps the operator side tidy under a cloud-console brand.

Defenders who only hardened SOHO edges after the April activity still face the hospitality copy of the same idea. The lesson transfers: any shared edge device that answers DNS for Microsoft services and forces users through a captive step is a candidate for this pattern until management access, patching and monitoring match its exposure.

Shared Portal Infrastructure Is Now Fair Game

Microsoft noted commonalities in the equipment and management systems across multiple affected networks. That detail points beyond one-off hotel breaches toward possible access into shared services inside the captive-portal ecosystem itself. A supply-chain foothold of that kind multiplies the value of every successful compromise.

The same logic that once made SOHO routers attractive-weak management interfaces, long patch cycles, broad trust from every connected client-now applies to the boxes that greet conference attendees and hotel guests. Defenders who treat guest Wi-Fi as an unavoidable inconvenience rather than a high-value edge asset will keep discovering the same campaign under new names.

Storm-2945 has already shown it can pair classic network hijacking with modern social engineering, AI-generated tooling and cloud-focused token theft. The next iteration will not need a new hotel chain if the underlying portal platforms remain soft targets.

Corporate travelers will keep connecting. The durable response is to assume the portal is hostile and to make sure a successful redirect still hits a wall of Conditional Access, device compliance and least privilege.