Microsoft has linked a global campaign targeting hospitality Wi-Fi networks to the Russian threat actor Midnight Blizzard, also known as APT29.
The activity was previously disclosed in a report from cybersecurity company ReliaQuest, which detailed how the attacker changed DNS settings on Wi-Fi devices to steal Microsoft 365 accounts.
Besides attributing the campaign to Russian hackers tracked as Storm-2945 – a sub-cluster of Midnight Blizzard, Microsoft identified two malware families called CornFlake and ChocoShell with capabilities for persistent access, credential theft, surveillance, and data exfiltration.
Microsoft named the campaign CaptiveCrunch and believes it has been active since at least early May, although the threat actor has been running device and OAuth code phishing operations since February.
Attack chain
The attackers manipulate DNS and HTTP traffic on networks served by captive portal equipment, allowing them to intercept user connections to hotel and conference center Wi-Fi networks.
Like ReliaQuest, Microsoft was unable to determine the exact initial compromise, although it noted signs of breaches in shared infrastructure rather than isolated devices.
After modifying DNS settings, the attacker can redirect victims to phishing pages that impersonate Microsoft 365 login portals, or to device code phishing pages that abuse Microsoft Entra ID authentication flows. Microsoft observed this activity since July.
A third option not previously disclosed involves using fake browser and operating system update pages that deliver malware to Windows via ClickFix prompts for user verification.
source: Microsoft
Microsoft also found evidence in some ClickFix landings indicating that the threat actor is also targeting Android devices to deliver an APK file.
CornFlake and ChocoShell malware
Microsoft analyzed the two new Windows malware families and found that CornFlake is a Go-based remote access trojan (RAT) that offers the following capabilities:
- Remote shell access
- Keylogging
- Clipboard monitoring
- Screenshot capturing
- Microphone and webcam surveillance
- Browser credential and cookie theft
- Microsoft 365 session token theft
- File exfiltration
- USB monitoring
- System reconnaissance
When executed, CornFlake shows a fake progress window to distract the user while the binary copies to %AppData% for persistence.
According to the researchers, the bogus window can be configured to appear as a Windows update screen, a Defender virus scan, a disk optimization utility, a network diagnostics tool, a browser update prompt, or a document viewer installer.
Source: Microsoft
CornFlake disguises itself as “Cloud Sync Service” to appear as a legitimate Windows component, and uses multiple persistence mechanisms on the host, including Windows service registrations, registry run keys, named tasks, and a watchdog routine designed to restore any of the available persistence mechanisms.
The second payload, ChocoShell, is an in-memory PowerShell credential stealer that targets browser cookies, saved passwords, Microsoft 365 and Azure AD tokens, and Wi-Fi credentials.
.jpg)
Source: Microsoft
Based on the extensive comments in the code, Microsoft assesses that AI tools were likely used to develop the two pieces of malware.
The researchers also discovered an unprotected web-based management panel named FruitStone that the threat actor used to handle infected systems, browse victim files, execute PowerShell commands, and capture screenshots and keystrokes.
Microsoft recommends treating hotel and conference Wi-Fi as untrusted, using private cellular or managed connections whenever possible, and avoiding software updates or tools offered through captive portals.
It is also recommended to adopt phishing-resistant authentication with MFA and passkeys, disable Microsoft Entra device code authentication when not needed, and avoid using corporate credentials to register for guest Wi-Fi networks.
Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.
The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.
