Midnight Blizzard exploits public Wi-Fi portals

Microsoft has warned travellers and organisations about a Russian state-linked cyberespionage campaign that manipulates hotel and venue Wi-Fi networks to steal credentials, compromise cloud accounts and install surveillance malware.

The operation, named CaptiveCrunch, has been active since early May and is attributed to Storm-2945, an operational subgroup of Midnight Blizzard. The wider hacking organisation, also known as APT29 and Cozy Bear, has been linked by the United States and Britain to Russia’s Foreign Intelligence Service.

The attackers target wireless networks that use captive portals, the web pages commonly displayed when guests connect to Wi-Fi at hotels, airports, conference centres and other shared venues. By gaining control of traffic passing through these systems, the hackers can redirect users to malicious pages that appear to be legitimate login screens, verification checks or software updates.

The campaign presents a particular danger to corporate travellers because the fraudulent content is delivered through a network they expect to trust. Victims do not need to open a phishing email or visit an obviously suspicious website. The malicious page may appear automatically while their device checks whether the Wi-Fi connection has internet access.

Microsoft has observed widespread but selective compromises involving hospitality-related networks and other systems operated through captive-portal equipment in several countries. Investigators are still examining how the attackers obtained access to the affected infrastructure.

Similarities in the hardware and network-management systems used by multiple victims indicate that the hackers may have compromised shared service providers or elements of the captive-portal supply chain, rather than breaching every venue separately.

One strand of the campaign directs users towards counterfeit Microsoft service domains. Other landing pages exploit Microsoft’s legitimate device-code authentication process. Victims are instructed to enter a code on an authentic Microsoft login page, believing that they are completing the hotel or venue’s connection procedure.

The code is controlled by the attackers. When the user approves it, valid authentication tokens can be issued for the attacker’s session. This may provide access to email, files and other Microsoft 365 resources without requiring the hackers to steal a password or defeat multifactor authentication directly.

Other victims encounter fake browser repairs, Windows updates, antivirus scans or network-diagnostic prompts. Some pages employ the ClickFix social-engineering technique, telling users to copy commands and run them through Windows Terminal, PowerShell or another system utility.

The operation’s main Windows implant, called CornFlake, is a remote-access trojan written in the Go programming language. It can establish several persistence mechanisms, including scheduled tasks, registry entries and a Windows service disguised as a cloud synchronisation component.

Once installed, CornFlake can record keystrokes, monitor the clipboard, take screenshots, collect documents and steal browser credentials and session tokens. It can also activate microphones and cameras, scan removable drives and provide attackers with a remote command shell.

A second tool, ChocoShell, operates largely in memory and concentrates on extracting valuable identity data. Its targets include browser cookies, saved passwords, Microsoft 365 single sign-on tokens and stored Wi-Fi credentials.

The malware can use several privilege-escalation techniques and attempt to weaken security scanning. Stolen authentication tokens may allow operators to replay active sessions and enter corporate cloud environments without triggering the warnings normally associated with a password-based intrusion.

Microsoft also identified indications that Android devices could be targeted. Some malicious captive-portal pages instruct users to download and install an APK file, extending the risk beyond Windows laptops.

Artificial intelligence appears to have supported parts of the operation. Elements of the malicious code contain detailed developer comments and consistent formatting that point towards AI-assisted development. The attackers have also used AI in infrastructure preparation and social-engineering activity.

Travellers have been advised to regard hotel, conference and airport wireless networks as untrustworthy. Cellular data, mobile hotspots, eSIM connections and approved satellite services provide safer alternatives where practical. Enterprise-managed travel routers can also create encrypted tunnels to trusted corporate systems.