Microsoft disclosed on 31 July 2026 that Russian threat actor Storm-2945, a cluster attributed to Midnight Blizzard, has been systematically compromising hotel and conference venue Wi-Fi networks to harvest Microsoft 365 credentials from corporate travellers. The campaign, named CaptiveCrunch, has been active since at least May 2026, with device code phishing operations beginning as early as February. The operation deploys two purpose-built malware families — a Go-based remote access trojan and an in-memory PowerShell credential stealer — against users who connect through affected captive portals.
How CaptiveCrunch Works
The attack targets the captive portal infrastructure that hotels and conference centres use to authenticate guest Wi-Fi access. Storm-2945 manipulates DNS and HTTP traffic flowing through this infrastructure to redirect connecting users through actor-controlled systems. The initial compromise mechanism is under investigation, but Microsoft notes “notable commonalities in the equipment and management systems” across affected venues, suggesting systematic access to shared hospitality infrastructure rather than individually targeted site breaches.
Once a user connects through a compromised portal, Storm-2945 pursues two primary delivery paths: redirecting to fake Microsoft 365 login pages or device code phishing flows designed to register attacker-controlled devices with Entra ID, and delivering malware through counterfeit browser or operating system update prompts using ClickFix-style social engineering. Mobile devices connecting through affected networks have also been targeted with malicious APK payloads for Android.
Malware: CornFlake and ChocoShell
Where attackers achieve code execution, they deploy one or both of two custom malware families.
CornFlake is a Windows remote access trojan written in Go. It installs in %APPDATA%\svchost32\ and masquerades as a “Cloud Sync Service” for persistence. Its capability set is broad: keylogging, clipboard monitoring, screenshot capture, audio and video surveillance, monitoring for removable media, and credential theft from browsers including Microsoft 365 session tokens and Azure AD tokens. Microsoft’s analysis assessed that AI tooling likely assisted the malware’s development, based on code structure analysis.
ChocoShell is a PowerShell-based infostealer designed to operate entirely in memory — leaving no files on disk. It extracts browser session cookies, saved passwords, Microsoft 365 SSO tokens, and stored Wi-Fi credentials. The in-memory execution model significantly complicates endpoint detection.
Storm-2945 operators manage the campaign through FruitStone, a web-based C2 panel branded as “CloudSync Console.” The panel provides a dashboard for managing compromised endpoints, building and deploying new payloads, and reviewing collected data including screenshots, keystrokes, and browser credentials. Microsoft researchers found the panel had no authentication on any of its functions — a notable operational security failure that aided analysis.
Context and Threat Assessment
Midnight Blizzard, also tracked as APT29 and Cozy Bear, is a well-resourced Russian state-sponsored threat actor with a long history of targeting government, diplomatic, defence, technology, and financial sector organisations for intelligence collection. The group is responsible for the SolarWinds supply chain compromise and multiple campaigns against Western government Microsoft 365 tenants.
CaptiveCrunch reflects a tactical evolution toward harvesting credentials through infrastructure trusted by corporate travellers rather than direct targeting of organisational networks. The focus on captive portal environments is deliberate: travellers frequently use hotel Wi-Fi to access sensitive corporate resources, and the trust relationship they extend to login prompts in unfamiliar environments is exploitable in ways that are difficult to replicate against hardened corporate networks. The targeting of Entra ID and M365 SSO tokens specifically gives Storm-2945 persistent access to cloud environments and the resources connected to them — SharePoint, Teams, Exchange, and any integrated services.
Affected sectors include organisations whose personnel travel for business purposes, particularly finance, government, defence, technology, and consulting. Conference venues hosting industry or government events represent concentrated target pools for the campaign.
Recommended Actions
- Treat all hotel and conference Wi-Fi as untrusted. Route corporate device traffic through mobile hotspots or enterprise-managed travel connectivity rather than venue guest networks where possible.
- Block device code authentication flows at the Entra ID conditional access layer. Storm-2945 has used device code phishing against M365 tenants since at least February 2026.
- Deploy phishing-resistant MFA — passkeys or hardware tokens — for corporate accounts. SMS and push-notification MFA remain bypassable in the credential theft scenarios CaptiveCrunch employs.
- Never accept software updates through captive portal pages. Legitimate captive portals do not push operating system or browser updates.
- Review Entra ID sign-in logs and registered device lists for unexpected device registrations originating from hospitality networks, particularly in regions where senior personnel have recently travelled.
- Revoke active sessions and refresh tokens for any user who connected through a hotel or conference Wi-Fi network in the past 90 days and shows anomalous sign-in patterns.