Hijacked Hotel Wi-Fi Serves Fake Updates to Deploy CornFlake RAT in CaptiveCrunch Campaign

Microsoft has disclosed a cyber espionage campaign, tracked as CaptiveCrunch, that abuses hijacked hotel Wi-Fi captive portals to deliver a remote access trojan (RAT) called CornFlake. The operation is attributed to Storm-2945, an operational sub-cluster of the Russian state-sponsored group APT29 (Midnight Blizzard, Cozy Bear), which is linked to Russia’s Foreign Intelligence Service (SVR).

According to Microsoft’s report, attackers gained administrative control of captive portal gateways, which also served as DNS resolvers for connected devices. By forging DNS responses, they redirected victims’ automatic connectivity checks to fake browser or operating system update pages. Some of these pages used ClickFix social engineering to trick users into running attacker-supplied commands. The gateway only redirects traffic; the victim must still download and execute the payload.

CornFlake is a Go-based implant that copies itself to %APPDATA%svchost32svchost32.exe and registers a service named Cloud Sync Service. It can capture screenshots, record clipboard contents, steal browser cookies and saved passwords (including those protected by Chrome App-Bound Encryption), scan removable media, and open a remote shell. It also establishes persistence via a Registry Run key and a scheduled task, with a watchdog that restores removed persistence mechanisms.

Additionally, researchers identified ChocoShell, an in-memory PowerShell stealer that collects Microsoft 365 and Azure Active Directory access and refresh tokens, plus Web Account Manager (WAM) tokens, from the Token Broker cache. These tokens can enable session replay without browser cookies.

Since July 16, some CaptiveCrunch landing pages have redirected guests to Microsoft’s device code authentication flow. If a victim enters the attacker-supplied code on Microsoft’s legitimate sign-in page, the attacker-controlled session gains MFA-satisfied access. Microsoft recommends blocking this flow via Conditional Access where not needed.

ReliaQuest, which investigated the compromised networks, recommends using an always-on, full-tunnel VPN to ensure DNS queries go through corporate resolvers before the venue’s gateway can answer. Travelers are advised to reject any software updates, certificates, or security utilities offered through captive portals.

The initial compromise vector remains under investigation. ReliaQuest assesses with low-to-medium confidence that exposed management interfaces and weak or reused administrator credentials may have been exploited. Microsoft has not named any affected hotel, venue, or captive portal vendor.