Security researchers and Microsoft Threat Intelligence have issued a critical warning to business travelers after discovering a global cyber espionage campaign targeting hotel and conference center Wi-Fi networks. Attributed to the notorious Russian state-sponsored threat group Midnight Blizzard (also known as APT29 or Cozy Bear), the operation is tracked by Microsoft under the moniker CaptiveCrunch. Instead of relying on traditional phishing emails or malicious attachments, the attackers compromise underlying network infrastructure—specifically captive portal gateways—to intercept connection attempts and force guests onto fraudulent authentication portals.
The campaign poses a severe operational threat to corporate executives, legal advisors, government officials, and financial professionals who connect to public Wi-Fi networks while traveling. By compromising edge routing hardware and captive portals, the threat actors can execute Domain Name System (DNS) poisoning and HTTP redirection. When connected devices attempt to resolve legitimate corporate endpoints like Microsoft 365 login pages, the compromised gateway quietly redirects the victim’s browser to convincing lookalike landing pages designed to harvest credentials and session tokens.
Custom Malware Strain Arsenal: CornFlake, ChocoShell, and FruitStone
Beyond simple credential harvesting, the CaptiveCrunch campaign distinguishes itself through the deployment of sophisticated custom malware tailored for post-exploitation espionage. Security analysis revealed two primary malware families explicitly engineered to compromise enterprise accounts and extract corporate secrets from infected endpoints.
The first strain, named CornFlake, is a custom Go-based remote access trojan (RAT) equipped with extensive surveillance capabilities. CornFlake enables the attackers to log keystrokes, capture desktop screenshots, covertly activate webcams, and extract authenticated Microsoft 365 session tokens directly from active browser processes. The second strain, known as ChocoShell, operates as an in-memory PowerShell credential stealer. ChocoShell specifically targets browser cookies, saved passwords, and Azure Active Directory (Entra ID) authentication tokens, allowing the adversaries to maintain persistent access and bypass traditional multi-factor authentication (MFA) protocols. In some instances, the attackers also leverage ClickFix tactics—presenting users with fake browser or operating system update prompts—to trick targets into executing the payload manually. Investigators also uncovered an unprotected central management panel dubbed FruitStone, which the threat actors used to command infected systems across multiple jurisdictions.
Technical Mechanics and Mitigation Strategies for Enterprise Defense
The mechanics of the attack exploit fundamental trust assumptions built into public networking gear. Cybercriminals typically gain initial administrative access to hotel Wi-Fi gateways by scanning for internet-facing management interfaces secured by default, weak, or reused credentials. Once administrative control is secured, the attackers modify the device’s internal DNS settings, ensuring that unencrypted DNS queries originating from guest laptops are redirected toward attacker-controlled IP addresses before ever reaching external resolvers like Google or Cloudflare.
Because this network-level hijacking occurs below the endpoint’s standard visibility, traditional endpoint security tools often fail to flag the initial redirection. To mitigate these dangerous risks, cybersecurity experts recommend enforcing always-on, full-tunnel Virtual Private Networks (VPNs) or Secure Access Service Edge (SASE) solutions on all corporate devices used abroad. VPN encryption ensures that all web queries and DNS lookups travel directly to trusted corporate resolvers, neutralizing local gateway manipulation. Additionally, enterprises should implement phishing-resistant MFA solutions, such as FIDO2 security keys, and disable device code authentication protocols when not strictly required.
