Connecting to the hotel wifi has become an automatic gesture: you open the laptop, the establishment’s welcome screen appears, you accept the terms and you are in. Microsoft has just put a name to whoever has been exploiting exactly that gesture since May. Its threat intelligence team attributes to Storm-2945, a subgroup of Midnight Blizzard — the actor linked to the Russian Foreign Intelligence Service (SVR), also known as APT29 or Cozy Bear — a global campaign named CaptiveCrunch that hijacks the captive portals of hotels and conference centers to steal corporate credentials.
What a captive portal is and why it is a perfect target
The captive portal is that intermediate page that intercepts your browsing until you accept the terms of the public wifi. To work, it needs to legitimately manipulate your DNS traffic, that is, decide which server each address you type takes you to. That power is exactly what the attackers have wanted to inherit.
The method, described by the security firm ReliaQuest last July 23, consists of compromising the wifi gateway equipment — SOHO-type routers, the same ones many SMBs have in the closet — and modifying their DNS configuration to redirect users to infrastructure controlled by the attackers. From there, the adversary-in-the-middle (AitM) technique comes into play: the visitor believes they are talking to Microsoft, but someone is listening and keeping everything along the way.
ReliaQuest documented compromised equipment in hotels and conference centers in the United States, India and Saudi Arabia, in addition to four domains registered by the attackers to impersonate Microsoft services. The observed traffic came from organizations in financial services, professional services, law firms, healthcare, energy and retail. It is not a sectoral attack: it is an attack on whoever travels, whatever sector they are from.
Fake browser updates, a Go RAT and a panel called FruitStone
Once the traffic is redirected, the campaign deploys two paths. The first is malware: remote access trojans written in Go that present themselves as browser updates, the oldest and most effective lure in the playbook. Microsoft identifies the CornFlake implant — a RAT and info stealer — and ChocoShell, a PowerShell-based infostealer, managed from a web command-and-control panel called FruitStone.
The capabilities are not minor: device reconnaissance, theft of credentials and session tokens, file collection and keystroke logging, audio and video surveillance, and access to a remote console. The attackers have also used variants of the ClickFix technique — the one that asks you to copy and paste a command “to fix” a supposed error — and have probed Android users by inviting them to install an APK file.
The device code trick: when phishing uses the real page
The most uncomfortable part is what Microsoft has seen in the last two weeks. Some landing pages no longer ask for the password: they direct the victim to the device code authentication flow of Microsoft Entra ID and tell them to enter a code on Microsoft’s authentic sign-in page. The user types their data on a legitimate domain, with its correct certificate and its green padlock, and what they are really doing is authorizing the attacker’s session.
Microsoft clarifies that the technique is not new — they have been observing it in Midnight Blizzard since August 2024 — but warns that integrating it into a captive portal greatly increases the likelihood that the request will be perceived as legitimate. There is the leap in quality: there is no fake website to detect.
From the GRU to the SVR: an attribution that has changed
It is worth clarifying a point that was blurry in the first headlines. ReliaQuest noted similarities with FrostArmada, the operation attributed to APT28 (Forest Blizzard, Fancy Bear) and linked to Russian military intelligence (GRU), but did not go so far as to attribute the campaign: neither the infrastructure nor the domains matched those of APT28, and the attack on captive portals was not documented before. The firm also observed that the DNS poisoning redirected all users indiscriminately, a sign of a “less sophisticated or less careful” actor. It has been Microsoft that closed the circle by pointing to Storm-2945 and, therefore, to the SVR’s orbit rather than the GRU’s. The company adds a revealing detail: the group has supported “a significant part” of these operations with artificial intelligence tools.
What you can do next time you travel
The practical recommendation is boring and it works. Do not install any update that a public wifi network offers you: browsers do not update that way, ever. Be wary of any screen that asks you to copy a command or enter a numeric code on a Microsoft page that you did not open yourself. Use a corporate VPN from the very first second, or share data from your phone, which is cheaper than an incident. And on the companies’ side: reviewing the device code flow in Entra ID — restricting or disabling it if not used — is probably the measure with the best effort-to-avoided-risk ratio in this whole story.
