Hijacked Hotel Wi-Fi Pushes Fake Updates to Deliver Surveillance Malware

The operation, tracked as CaptiveCrunch and attributed to Storm-2945 (a sub-cluster of Midnight Blizzard/APT29/Cozy Bear), hijacks hotel Wi-Fi captive portal gateways to perform DNS poisoning. The compromised gateway acts as the DNS resolver for connected devices, allowing attackers to forge DNS responses and redirect traffic. Victims are served fake browser or OS update pages; some use ClickFix instructions prompting users to run attacker-supplied commands via terminal or Windows utilities. Since July 16, some landing pages redirect guests into Microsoft's device code authentication flow, where entering an attacker-supplied code grants the attacker's session MFA-satisfied access. The primary malware delivered is CornFlake, a Go-based RAT that: copies itself to %APPDATA%\svchost32\svchost32.exe, registers as a service named 'Cloud Sync Service', takes idle-triggered screenshots, records clipboard contents with active window title, steals browser cookies and saved passwords (including Chrome App-Bound Encryption-protected cookies), scans removable media, opens a remote shell, uses a Registry Run key and scheduled task for persistence, and deploys a watchdog to restore removed persistence mechanisms. A secondary tool, ChocoShell, is an in-memory PowerShell stealer that collects Microsoft 365 and Azure Active Directory access/refresh tokens and Web Account Manager (WAM) tokens from .tbres files in the Token Broker cache, enabling session replay without browser cookies. Microsoft identified common equipment and management systems across affected networks, suggesting possible compromise of shared captive portal infrastructure rather than isolated venues. The initial compromise vector is under investigation but may involve exposed management interfaces and weak/reused administrator credentials.