Hackers working for Russian intelligence have compromised Wi-Fi networks at hotels and conference centers to push fake software updates that install espionage tools on travelers' devices. According to research published by Microsoft Threat Intelligence on July 31, the operation—dubbed CaptiveCrunch—has been running since early May and is linked to Storm-2945, a group within Midnight Blizzard. The US and UK governments have previously tied Midnight Blizzard (also called APT29, the Dukes, or Cozy Bear) to Russia's Foreign Intelligence Service, the SVR. Microsoft is still investigating how the portals were breached but observed similarities in the equipment and management systems across targeted networks, suggesting attackers may have exploited shared services within the captive portal ecosystem rather than breaking into individual venues one by one.
The attackers intercepted automated connectivity checks that browsers and operating systems perform when joining a new network, responding with pages that offered fake browser or system updates. These landing pages used ClickFix tactics, showing bogus verification errors with instructions to paste and run commands. Some pages also delivered an APK file, pointing to potential targeting of Android devices. Starting July 16, certain pages redirected users into device code authentication flows, telling them to enter an attacker-provided code on an authentic Microsoft sign-in page. ReliaQuest, which documented part of the campaign on July 23, found the activity at hotels, conference centers, and other shared locations, with corporate travelers' accounts as the primary targets.
The main tool is CornFlake, a remote access trojan written in Go that shows a fake progress window during installation before registering itself as a Windows service called Cloud Sync Service. It includes keylogging, screenshot capture, microphone and webcam surveillance, browser credential theft, and a remote shell, along with a watchdog function that restores any persistence methods that defenders try to remove. A second tool, ChocoShell, is a PowerShell infostealer that operates entirely in memory, shutting down the Antimalware Scan Interface before stealing browser cookies, saved passwords, Microsoft 365 single sign-on tokens, and Wi-Fi credentials. Microsoft said the developer comments in ChocoShell named specific detection signatures and explained each evasion technique, indicating possible AI-assisted code generation. The company noted the actor used AI across a significant portion of the operation and thanked Anthropic and OpenAI for their support during the investigation. Operators manage the campaign from FruitStone, a web panel disguised as a fictitious enterprise cloud product to match the implant's cover story.
The technique works because embedding malicious requests inside a captive portal—the login page users expect when connecting to public Wi-Fi—makes them appear more legitimate than traditional phishing. Microsoft said the device code authentication technique wasn't new, but placing it in a captive portal context increased the likelihood that targets would trust the request. The widespread use of shared captive portal infrastructure means a single compromise can reach travelers across multiple venues, making it an efficient vehicle for targeting corporate accounts while employees are away from their normal security protections.
Microsoft's guidance includes treating hotel, conference, and airport wireless as untrusted, choosing cellular or eSIM connections instead, and never installing software presented through a captive portal. The company also recommended blocking device code flow where it's not needed and deploying passkeys. For corporate travelers, the bottom line is clear: that software update prompt on hotel Wi-Fi might be Russian intelligence watching and listening.