Storm-2945, a sub-cluster of Midnight Blizzard, is running CaptiveCrunch to hijack hotel and conference Wi-Fi captive portals, redirecting travelers to attacker-controlled sites for Microsoft 365 credential theft, device code phishing, and malware delivery. The campaign uses CornFlake and ChocoShell, manipulates DNS/HTTP traffic, and extends to Android via malicious APKs. #Storm2945 #MidnightBlizzard #CaptiveCrunch #CornFlake #ChocoShell #Microsoft365 #MicrosoftEntraID #Android

Microsoft linked the CaptiveCrunch campaign to Midnight Blizzard (APT29), saying it targets hotel and conference Wi-Fi networks to steal Microsoft 365 accounts through DNS tampering, phishing, and malware delivery. The campaign uses the CornFlake and ChocoShell malware families, along with the FruitStone panel, to maintain access, collect credentials, and exfiltrate data. #MidnightBlizzard #APT29 #CaptiveCrunch #CornFlake #ChocoShell #FruitStone

Microsoft says hijacked hotel Wi-Fi captive portals were used to push a fake browser or OS update that delivered CornFlake, a RAT capable of stealing webcam images, microphone audio, keystrokes, cookies, and passwords. The activity, tracked as CaptiveCrunch and attributed by Microsoft to Storm-2945, also used device code phishing and ChocoShell...

Russian threat actor Midnight Blizzard (Storm-2945) is exploiting an Outlook Web Access XSS vulnerability (CVE-2026-42897) and hijacking hotel Wi-Fi to...

Russian threat actor Midnight Blizzard (Storm-2945) is exploiting an Outlook Web Access XSS vulnerability (CVE-2026-42897) and hijacking hotel Wi-Fi to...

Midnight Blizzard, the Russian threat actor tied to the country’s foreign intelligence service, has spent months targeting users of public Wi-Fi networks at places like hotels and conference centers, according to new findings from Microsoft Threat Intelligence. Overview of the CaptiveCrunch attack flow (Source: Microsoft) Microsoft named the campaign CaptiveCrunch and identified two malware strains behind it, CornFlake and ChocoShell. Building on earlier research from security firm ReliaQuest, published July 23, Microsoft ties this activity …

Russian state-backed cyber-espionage group Midnight Blizzard has compromised hotel and conference center Wi-Fi networks across several countries, using

Hotel Wi-Fi gateways are being hijacked to push fake updates and steal Microsoft 365 tokens from traveling staff—no password needed, just a refresh token replay. #infosec #cybersecurity

A routine connection to hotel Wi-Fi can end in the theft of corporate email, passwords, and sensitive files - all before the traveler ever clicks a suspicious link. In the CaptiveCrunch campaign, threat actors compromise guest network gateways and redirect connected devices to phishing pages or malware-serving infrastructure. Scope and Timeline of the Campaign Attacks against Wi-Fi networks began in early May 2026 and have since affected multiple countries.

ChocoShellは、Microsoftが新たに公表した「CaptiveCrunch」キャンペーンで使用されているPowerShellベースの情報窃取マルウェアです。世界各地の侵害されたホスピタリティネットワークに接続する旅行者から、Microsoft 365トークン、ブラウザセッション、Wi-Fi認証情報を盗み出

Midnight Blizzard hijacks Wi-Fi captive portals to steal Microsoft 365 credentials and deliver CornFlake and ChocoShell in the CaptiveCrunch campaign.

Microsoft attribue à APT29 une campagne mondiale de compromission des réseaux Wi-Fi hôteliers. Les malwares ChocoShell et CornFlake siphonnent les sessions M365 des voyageurs d’affaires.