Midnight Blizzard Hijacks Hotel Wi-Fi: Inside the CaptiveCrunch Campaign Stealing Cloud Credentials from Travelers
You land after a nine-hour flight, drop your bags in a hotel room, and do what every business traveler does on autopilot: connect to the Wi-Fi. A login page pops up, looking exactly like the one you've seen in a hundred other hotels. You click through. Somewhere between that click and your next Teams call, a Russian intelligence-linked threat actor may have just planted a remote access trojan on your laptop and grabbed your Microsoft 365 session token.
That's not a hypothetical. It's the operating model behind CaptiveCrunch, a campaign Microsoft Threat Intelligence disclosed on July 31, 2026, and tied to Storm-2945, a sub-cluster of the Russian state-sponsored group known as Midnight Blizzard (APT29, Cozy Bear, formerly Nobelium). This is one of the more unsettling shifts in nation-state tradecraft this year: instead of phishing your inbox, they're phishing the network itself.
Table of Contents
- What Happened: The CaptiveCrunch Campaign
- How the Attack Actually Works
- The Malware Arsenal: CornFlake, ChocoShell, and FruitStone
- Why Cloud Accounts Are the Real Target
- Scope: Who's Being Hit and Where
- Indicators of Compromise
- Detection: What SOC Teams Should Hunt For
- Prevention: Commands and Configuration Changes
- Expert Tips for Travelers and Security Teams
- Related Reading
- FAQ
- Final Word
What Happened: The CaptiveCrunch Campaign
Since early May 2026, Storm-2945 has been quietly compromising the captive portal infrastructure that hotels, conference centers, and other venues use to authenticate guest Wi-Fi users. That's the gateway equipment that shows you the "Accept Terms & Connect" page before you get internet access. Once that gateway is under attacker control, every device that joins the network becomes a potential victim.
This isn't Midnight Blizzard's first rodeo with credential theft dressed up as something routine. The same operators have previously abused Microsoft Teams chat to run social-engineering credential theft against enterprise targets, and independent research from ReliaQuest published on July 23, 2026, first surfaced part of this hospitality-network activity before Microsoft's fuller attribution followed a week later.
How the Attack Actually Works
Here's the part that makes CaptiveCrunch dangerous: it doesn't rely on a victim clicking a suspicious link in an email. It hijacks a moment of routine, low-suspicion behavior — joining Wi-Fi at a hotel.
- DNS poisoning at the gateway. The compromised captive portal equipment manipulates DNS responses so a connecting device's browser resolves to attacker-controlled infrastructure instead of the legitimate portal.
- A convincing landing page. The victim sees what looks like a normal hotel Wi-Fi sign-in page — or a fake browser/OS update prompt injected into the flow.
- ClickFix-style social engineering. On some pages, if an automated "verification" step fails, the victim is instructed to manually open a terminal or Windows utility and run a command supplied by the attacker. This is a classic ClickFix pattern: the gateway sets the trap, but the human still has to pull the trigger.
- Device-code phishing. Since mid-July, some CaptiveCrunch landing pages have pushed victims into a legitimate Microsoft OAuth device-code flow — tricking the user into entering an attacker-generated code on a real Microsoft sign-in page, which silently authorizes the attacker's session with the victim's identity.
- WPAD abuse. The threat actor also leverages Web Proxy Auto-Discovery (WPAD) to influence how a device routes its web traffic, which can expose authentication activity that users assume is protected.
What makes this technically clever is that the malicious redirect happens during the automated "connectivity check" your phone or laptop runs the instant it joins a new network — before you've even opened a browser tab.
The Malware Arsenal: CornFlake, ChocoShell, and FruitStone
Microsoft's report names three distinct tools in the CaptiveCrunch toolkit, and each plays a different role in the intrusion chain.
CornFlake
A Go-based remote access trojan delivered disguised as a browser or OS update. It displays a fake installation progress window to keep the victim calm while it installs, then registers itself as a Windows service disguised under an innocuous name resembling a cloud sync utility. Its capability set includes keystroke logging, screenshot capture, microphone and webcam surveillance, browser credential theft, a remote shell for hands-on-keyboard access, and a watchdog routine that automatically restores its own persistence mechanisms if a defender removes them.
ChocoShell
A PowerShell-based infostealer that runs entirely in memory to avoid dropping files on disk. It disables the Antimalware Scan Interface (AMSI) before harvesting browser passwords, cookies, Microsoft 365 single sign-on tokens, Azure AD authentication tokens, and saved Wi-Fi credentials. It also abuses Chrome's remote debugging interface to pull decrypted cookies directly out of a live browser session — a technique that sidesteps cookie encryption protections entirely.
FruitStone
A web-based command-and-control panel that lets Storm-2945 operators manage infected endpoints at scale: deploying additional payloads, reviewing exfiltrated credentials, and pulling captured screenshots from a centralized dashboard.
Why Cloud Accounts Are the Real Target
None of this is about the hotel network itself. The captive portal is just the delivery mechanism. The actual objective is a foothold in the victim's cloud identity — Microsoft 365, Azure AD, email, SharePoint, internal apps behind SSO.
A stolen session token or device-authorization grant lets an attacker access those services without ever touching the victim's laptop again. That's what makes this campaign so relevant to enterprise security teams: multi-factor authentication is important, but it does not stop token theft or session hijacking after the fact. If the attacker steals a live session token, MFA already happened — for the attacker's benefit.
This lines up with the broader trend of adversary-in-the-middle (AiTM) phishing that's been chipping away at the assumption that MFA alone is sufficient protection for Microsoft 365 and Google Workspace accounts.
Scope: Who's Being Hit and Where
ReliaQuest's independent investigation found compromised captive portal gateways across multiple U.S. cities, as well as in India and Saudi Arabia — mostly at hotels. Traffic observed spanned financial services, professional services, legal, healthcare, energy, and retail organizations, which suggests Storm-2945 is casting a wide net for traveling employees generally rather than hunting one specific industry vertical.
Microsoft has also noted commonalities in the equipment and management systems across affected venues, raising the possibility that the intrusion path runs through shared infrastructure used by multiple captive portal vendors rather than one-off compromises of individual hotels.
Notably, Microsoft has drawn a distinction between CaptiveCrunch and an earlier, similarly styled DNS-hijacking operation it attributed to Forest Blizzard (APT28/Fancy Bear, Russia's GRU) in April 2026. The tradecraft overlaps, but Microsoft attributes CaptiveCrunch specifically to Storm-2945 — a reminder that more than one Russian-linked cluster is currently experimenting with hijacking public network infrastructure.
Indicators of Compromise
| Type | Indicator | Description |
|---|---|---|
| Campaign name | CaptiveCrunch | Microsoft's designation for the traffic-manipulation campaign targeting captive portal networks |
| Threat cluster | Storm-2945 | Operational sub-cluster of Midnight Blizzard responsible for the campaign |
| Parent actor | Midnight Blizzard / APT29 / Cozy Bear | Russia SVR-linked threat actor |
| Malware | CornFlake | Go-based RAT delivered via fake update prompts; registers as a disguised Windows service |
| Malware | ChocoShell | In-memory PowerShell infostealer; disables AMSI, harvests browser and M365 tokens |
| Infrastructure | FruitStone | Web-based C2 panel for managing infected hosts |
| Network mechanism | WPAD abuse | Automatic proxy discovery abused to intercept or redirect traffic |
| Technique | Device-code / OAuth phishing | Victims tricked into authorizing attacker sessions via legitimate Microsoft sign-in flow |
Note: Always defang IPs and domains (e.g., using [.] notation) before storing or sharing indicators outside a controlled threat intel platform such as MISP, VirusTotal, or your SIEM.
Detection: What SOC Teams Should Hunt For
If your organization has employees who travel, here's where to start looking:
- New service creation with generic "sync" or "cloud" naming shortly after a device reconnects from an untrusted or unmanaged network — a possible CornFlake persistence indicator.
- AMSI bypass attempts in PowerShell logs (Event ID 4104 with obfuscated script blocks), especially combined with in-memory execution and no corresponding file write.
- Unexpected device-code authentication prompts completed shortly after a user reports connecting to hotel or conference Wi-Fi — correlate with sign-in logs in Azure AD / Entra ID for anomalous device registration.
- DNS resolution anomalies on corporate devices when off the corporate network — compare resolved IPs against expected ranges for known services.
- Chrome remote debugging port activity (default 9222) initiated by an unexpected parent process — a signature of the cookie-theft technique ChocoShell uses.
Prevention: Commands and Configuration Changes
These are defensive, read-only or hardening actions — nothing here is destructive, but always test configuration changes in a staging group before a fleet-wide rollout.
Check whether WPAD is enabled on a Windows endpoint:
netsh winhttp show proxyThis shows the current WinHTTP proxy configuration. If WPAD or an unexpected auto-config URL is active and not required by policy, it should be disabled via Group Policy (Computer Configuration > Administrative Templates > Windows Components > Internet Explorer > Disable changes to Automatic Configuration settings, alongside disabling the WinHTTP AutoProxy service where not needed).
Reset WinHTTP proxy settings to remove an unauthorized auto-config:
netsh winhttp reset proxyUse this if you suspect a device picked up a rogue proxy configuration from a hostile network. It clears any WinHTTP-level proxy settings back to direct access, pending your organization's approved configuration.
Recommended enterprise controls:
- Enforce always-on, full-tunnel VPN so all DNS and authentication traffic routes through trusted corporate resolvers before it ever touches hotel or conference network infrastructure.
- Restrict proxy configuration retrieval to approved internal hosts only.
- Enable encrypted DNS (DNS-over-HTTPS or DNS-over-TLS) in strict mode to reduce the chance of a malicious DNS response being accepted.
- Block or tightly restrict OAuth device-code authentication flows for accounts and apps that don't genuinely need them.
- For managed devices, consider preventing Wi-Fi connections to networks not provisioned through your MDM/Intune policy.
- Train travelers to stop immediately if a browser throws a certificate or privacy warning on a hotel network — that warning is not routine noise on these networks the way it might feel.
Expert Tips for Travelers and Security Teams
- Mobile data first. For anything involving a cloud login, prefer your phone's hotspot or an eSIM data plan over hotel Wi-Fi whenever it's practical.
- VPN before browser. If hotel Wi-Fi is unavoidable, connect your VPN before opening a browser tab — not after you've already clicked through the captive portal.
- Treat "update available" prompts on public Wi-Fi as hostile by default. Legitimate OS and browser updates don't usually arrive as an urgent pop-up the moment you join a new network.
- Never paste a device code you didn't request. If a page asks you to enter a code on a Microsoft sign-in screen and you didn't initiate that flow yourself, stop.
- Security teams: review travel policies now. This is a good trigger to audit split-tunnel VPN exceptions that might let DNS or auth traffic leak outside protected routes.
Related Cybersecurity Topics You Should Explore
- CVE-2026-12935: The TP-Link Bug Every Router Owner Should Fix Now
- Adform Hack Turns Trusted Ad Script Into a Crypto Stealer
- The Security Story Hidden Inside Windows 11's Big Update
- SplitVPN Data Breach: 865K Users Exposed, 'No-Logs' Was a Lie
- Brinks Home Data Breach: The Phone Call That Cost Millions
- GPG Command Tutorial: The Encryption Trick Real SOC Analysts Use
- AI Found a Chrome Bug Hiding for 13 Years. Here's How.
- This Open-Source AI Agent Turns ChatGPT Into a Hacker
- GenieLocker Ransomware Explained: How Toy Ghouls Hack ESXi Servers
- ln Command Explained: How Hackers Abuse Symlinks to Hack Root
- NVIDIA BlueField Flaw Lets Hackers Hijack Cloud Servers
FAQ
Q: Is CaptiveCrunch a vulnerability in hotel Wi-Fi itself, or an attack on the equipment?
A: It's a compromise of the captive portal gateway equipment and DNS infrastructure venues rely on — not a flaw in Wi-Fi encryption standards. The attacker controls the network's front door, not the airwaves.
Q: Does this only affect Windows devices?
A: The named malware (CornFlake, ChocoShell) targets Windows, but the initial redirection and credential-phishing stages can affect any device — laptop, phone, or tablet — that connects through a compromised portal.
Q: Will MFA protect me from this attack?
A: Partially. MFA still blocks straightforward password reuse, but session token theft and device-code phishing can bypass MFA entirely by hijacking an already-authenticated session.
Q: How long has this campaign been active?
A: Microsoft has tracked the network traffic manipulation since early May 2026, with related AI-assisted device-code and OAuth phishing from the same cluster dating back to February 2026.
Q: Has a specific hotel chain or captive portal vendor been named?
A: No. As of Microsoft's disclosure, no specific hotel, venue, or captive portal vendor has been publicly identified.
Q: Is this the same group behind the 2024 Microsoft executive email breach?
A: Yes — Midnight Blizzard is the same actor Microsoft attributed to that January 2024 breach of senior leadership email accounts, and it's linked by U.S. and U.K. governments to Russia's SVR foreign intelligence service.
Final Word
CaptiveCrunch is a reminder that the weakest link in enterprise security isn't always the inbox — sometimes it's the network you trust by default because you're tired, jet-lagged, and just want to check email before a meeting. Nation-state actors have noticed that travelers lower their guard exactly when they should raise it.
If your organization has people on the road, this is worth a policy review today, not next quarter. Lock down WPAD, mandate full-tunnel VPN, and make "stop and ask security" the default reaction to any unexpected update prompt on a hotel network.
Found this useful? Share it with your travel-heavy teams, and drop a comment if you've seen similar captive-portal weirdness in the wild — real field reports help the whole community stay ahead of campaigns like this.