Picture this. You check into a hotel, connect to the Wi-Fi, and see a browser update prompt. It looks legitimate. You click it, install the update, and go about your day. But you just handed over your computer to a Russian cyber espionage group.
Microsoft has detailed a sophisticated campaign called CaptiveCrunch that does exactly this. The attackers hijack hotel Wi-Fi captive portals and serve fake browser updates to deliver a remote access trojan called CornFlake.
The operation is attributed to Storm-2945, which Microsoft assesses as a sub-cluster of Midnight Blizzard, better known as APT29 and Cozy Bear.
The U.S. and U.K. governments attribute the broader APT29 group to Russia's Foreign Intelligence Service. This is not a small-time operation. This is state-sponsored espionage targeting travelers.
Let me walk through how CaptiveCrunch works, what it delivers, and how you can protect yourself.
The Captive Portal Attack Vector
The CaptiveCrunch campaign relies on a clever attack vector. When you connect to hotel Wi-Fi, you are typically redirected to a captive portal page where you accept terms or enter a room number. The attackers have compromised the administrative control of those captive portal gateways.
Here is the critical detail. On the compromised networks that ReliaQuest investigated, the captive portal gateway also served as the DNS resolver assigned to connected devices. Administrative control of that gateway let the attackers forge Domain Name System answers and redirect the resulting traffic.
They could then redirect a laptop's automatic connectivity check to a fake browser or operating system update page. The user sees what appears to be a legitimate update prompt and installs the payload.
Microsoft has observed the traffic manipulation since early May across hospitality networks in several countries. The company has not named a specific hotel, venue, or captive portal vendor. But the scope of the operation suggests it is not isolated to a single location.
The CaptiveCrunch ClickFlow
The fake update pages in the CaptiveCrunch campaign use ClickFix instructions. These tell victims to open a terminal or another Windows utility and run an attacker-supplied command. The gateway controls where the user is sent, but it does not silently infect the endpoint. The victim still has to download or execute the payload.
This is an important distinction. CaptiveCrunch is based on social engineering as opposed to any automatic exploit. In order for the attack to be successful, the victim must execute the command as instructed.
A fake progress window holds the victim's attention while the malware installs. The user thinks they are updating their browser or operating system. In reality, they are deploying a sophisticated remote access trojan.
The Device Code Authentication Flow
Since July 16, some CaptiveCrunch landing pages have taken a different approach. The attackers redirect guests into Microsoft's device code authentication flow. Entering the attacker-supplied code on Microsoft's legitimate sign-in page can grant the attacker-controlled session multi-factor authentication-satisfied access.
This is a sophisticated twist. The user is entering a code on a legitimate Microsoft page. They think they are completing a legitimate authentication flow. But the code belongs to the attacker, who can now access the victim's Microsoft account with MFA already satisfied.
Microsoft recommends blocking this flow through Conditional Access wherever it is not needed. Organizations should review whether device code authentication is required for their users and restrict it if possible.
CornFlake: The Go-Based Implant
The payload delivered by CaptiveCrunch is a Go-based remote access trojan called CornFlake. The malware, when run, makes a copy of itself into %APPDATA%\svchost32\svchost32.exe and creates the svchost32 service with the name of Cloud Sync Service.
According to Microsoft's analysis of CornFlake, the following capabilities were found:
- Idle-triggered screenshots capturing what the user is viewing
- Clipboard recording with the active window title
- Browser cookie theft, including cookies protected by Chrome App-Bound Encryption
- Saved password extraction from browsers
- Removable media scanning and data theft
- Remote shell access for manual command execution
The malware also uses a Registry Run key and a scheduled task for persistence. A watchdog component restores any persistence mechanism that defenders remove. This layered approach makes CornFlake difficult to eliminate completely.
ChocoShell: The In-Memory Stealer
The CaptiveCrunch campaign also includes another tool called ChocoShell. This is an in-memory PowerShell stealer that collects Microsoft 365 and Azure Active Directory access and refresh tokens. It also targets Web Account Manager tokens from .tbres files in the Token Broker cache.
The stolen tokens can enable session replay without a browser cookie. If an attacker obtains these tokens, they can access the victim's cloud resources without needing to reauthenticate. This is a significant post-compromise capability.
Attribution to Storm-2945 and Midnight Blizzard
Microsoft tracks the CaptiveCrunch operation to Storm-2945, which it assesses as an operational sub-cluster of Midnight Blizzard, also known as APT29 and Cozy Bear. The U.S. and U.K. governments attribute the broader actor to Russia's Foreign Intelligence Service.
The U.K. National Cyber Security Centre and its international partners assess that APT29 is almost certainly part of Russia's Foreign Intelligence Service. This government attribution covers the broader APT29 group. The CaptiveCrunch-to-Storm-2945 link remains Microsoft's assessment, and no separate public technical report has independently corroborated it.
ReliaQuest documented the same Microsoft-impersonating domains and overlapping infrastructure eight days earlier. It said the tradecraft resembled APT28, the GRU unit also called Fancy Bear and Forest Blizzard, but stopped short of attribution because the assessment rests on TTP overlap rather than direct technical linkage.
Microsoft acknowledges the similarity to the Forest Blizzard router hijacking it disclosed in April while attributing CaptiveCrunch to Storm-2945. The attribution picture is complex, but the threat is real regardless of which group is responsible.
The Initial Compromise Vector
The initial compromise vector of the CaptiveCrunch campaign remains under investigation. ReliaQuest assesses with low-to-medium confidence that a combination of exposed management interfaces and weak or reused administrator credentials may have provided access. However, visibility constraints prevented confirmation.
This uncertainty is common in investigations of this nature. The attackers may have used multiple methods to gain initial access to the captive portal gateways. Once they had administrative control, they could manipulate DNS responses and redirect traffic.
Does the Campaign End in Compromise?
The reports document active redirection and malware delivery, but they do not quantify their reach or conversion. Without counts of successful executions, device-code approvals, or stolen accounts, the public record does not show how often a redirect became a compromise.
This is an honest assessment. The fact that attackers are redirecting traffic and serving malicious content is concerning. But the actual number of successful compromises is not yet clear.
The Compromised Provider Question
Microsoft found common equipment and management systems across the affected networks. The company says this could reflect access to shared services within portions of the captive portal ecosystem. If so, the compromises may not have been isolated to individual venues.
This is a significant point. The CaptiveCrunch campaign may have compromised a provider or shared service that supports multiple hotels. A single point of compromise could affect dozens or hundreds of venues. Microsoft has not named any affected provider.
Protecting Against CaptiveCrunch
- ReliaQuest recommends an always-on, full-tunnel virtual private network for travelers. This sends DNS queries through corporate resolvers before the venue's gateway can answer them. A VPN effectively bypasses the DNS manipulation that makes CaptiveCrunch possible.
- Researchers also advise travelers to reject software updates, certificates, browser updates, troubleshooting tools, or security utilities offered through captive portals. No legitimate hotel Wi-Fi portal will require you to install a browser update.
- For organizations, Microsoft recommends blocking the device code authentication flow through Conditional Access wherever it is not needed. This prevents the MFA-bypass technique used in some CaptiveCrunch attacks.
The Bottom Line
CaptiveCrunch campaign is a sophisticated operation where hotel Wi-Fi captive portals will be used to distribute malware. Hackers will use DNS to force victims to access fake update website. The CornFlake RAT has full surveillance capabilities.
The attribution to Russia's Foreign Intelligence Service via the APT29/Midnight Blizzard is crucial. This is not a random cybercrime operation. This is state-sponsored espionage targeting travelers.
Travelers should use VPNs on public Wi-Fi networks. They should never install software updates from hotel Wi-Fi portals. And they should be suspicious of any prompt asking them to open a terminal or run a command.
The CaptiveCrunch campaign is ongoing. Stay safe out there.
FAQ Section
What is the CaptiveCrunch campaign?
CaptiveCrunch is a cyber espionage operation where attackers compromise hotel Wi-Fi captive portals to serve fake browser updates.The campaign provides the CornFlake Go-based remote access trojan and is linked with Storm-2945 sub-cluster of APT29 threat group from Russia.
How does CaptiveCrunch deliver malware?
Attackers compromise the administrative control of captive portal gateways and forge DNS answers. This redirects users to fake update pages that prompt them to run malicious commands, installing the CornFlake RAT on their systems.
What can CornFlake do?
CornFlake can capture screenshots, record clipboard contents, steal browser cookies and saved passwords, scan removable media, and open a remote shell. It uses multiple persistence mechanisms and includes a watchdog to restore any that are removed.
How does device code authentication abuse work in CaptiveCrunch?
Attackers redirect users into Microsoft's device code authentication flow. This is done by entering a code provided by the attacker on a legitimate Microsoft sign-in web page. This allows the attacker MFA-satisfactory access to the victim's account.
How can travelers protect against CaptiveCrunch?
Use an always-on, full-tunnel VPN that sends DNS queries through corporate resolvers. Don’t accept any software updates, certificates, or security programs that may be installed via the captive portal. Beware of any instruction to enter commands in the terminal window.
