Russian APT29 (Midnight Blizzard) Targets Hotels with Wi-Fi Spoofing Malware to Steal Microsoft
Microsoft has officially linked a global campaign targeting hospitality Wi-Fi networks to the Russian threat actor Midnight Blizzard (also tracked as APT29 and Storm-2945). The activity, now named CaptiveCrunch by Microsoft, represents a sophisticated attack chain that compromises shared Wi-Fi infrastructure in hotels and conference centers to steal Microsoft 365 credentials and session tokens.
The campaign was first disclosed in a report from cybersecurity company ReliaQuest, which detailed how attackers manipulate DNS settings on Wi-Fi devices to intercept user connections. Microsoft's subsequent analysis has painted a more complete picture of the threat, revealing two custom malware families—CornFlake and ChocoShell—and an unusual third delivery method that combines social engineering with automated payload execution.
Learn more about AI cybersecurity threats in 2026 →
How the CaptiveCrunch AI Cybersecurity Threat Operates
The attack chain is deceptively straightforward once you're connected to an infected network. Attackers manipulate DNS and HTTP traffic on networks served by captive portal equipment, allowing them to intercept connections from guests at hotels and conference centers.
Here's where it gets interesting: Microsoft was unable to determine the exact initial compromise, but noted signs of breaches in shared infrastructure rather than isolated devices. That's a crucial detail—it means the attackers aren't targeting individual routers one at a time. They're hitting the shared backbone.
After modifying DNS settings, the attacker can redirect victims to phishing pages that impersonate Microsoft 365 login portals, or to device code phishing pages that abuse Microsoft Entra ID authentication flows. Microsoft observed this activity since July 2026, though the campaign itself has been active since at least early May, with phishing operations dating back to February.
There's a third option Microsoft didn't previously disclose, and it's particularly clever: fake browser and operating system update pages that deliver malware to Windows systems through ClickFix prompts for user verification. The ClickFix mechanism forces users to manually verify the update by opening a PowerShell command, which then executes the malicious payload. Microsoft also found evidence in some ClickFix landings indicating that the threat actor is targeting Android devices to deliver APK files as well.
The Dual-Malware Arsenal: CornFlake and ChocoShell
Microsoft's analysis of the two Windows malware families reveals a sophisticated toolkit designed for persistent access, credential theft, surveillance, and data exfiltration.
CornFlake is a Go-based remote access trojan (RAT) with an impressive capability list:
- Remote shell access
- Keylogging
- Clipboard monitoring
- Screenshot capturing
- Microphone and webcam surveillance
- Browser credential and cookie theft
- Microsoft 365 session token theft
- File exfiltration
- USB monitoring
- System reconnaissance
When executed, CornFlake shows a fake progress window to distract the user while the binary copies itself to %AppData% for persistence. The bogus window is configurable—it can appear as a Windows update screen, a Defender virus scan, a disk optimization utility, a network diagnostics tool, a browser update prompt, or even a document viewer installer. CornFlake also disguises itself as "Cloud Sync Service" to appear as a legitimate Windows component.
The malware uses multiple persistence mechanisms on the host, including Windows service registrations, registry run keys, named tasks, and a watchdog routine designed to restore any of the available persistence mechanisms if they're removed.
ChocoShell is an in-memory PowerShell credential stealer that targets browser cookies, saved passwords, Microsoft 365 and Azure AD tokens, and Wi-Fi credentials. Unlike CornFlake, it doesn't write anything to disk—it lives entirely in memory, making it harder to detect with traditional file-based antivirus solutions.
Based on the extensive comments in the code, Microsoft assesses that AI tools were likely used to develop both pieces of malware. This is a significant finding, particularly in the context of AI cybersecurity threats in 2026, as it demonstrates how threat actors are leveraging artificial intelligence to accelerate malware development and improve code quality.
See how other organizations are responding to AI cybersecurity threats →
The FruitStone Management Panel
Microsoft researchers also discovered an unprotected web-based management panel named FruitStone that the threat actor uses to handle infected systems. Through this panel, attackers can browse victim files, execute PowerShell commands, and capture screenshots and keystrokes.
The panel's lack of authentication is notable—it suggests the threat actor prioritized functionality over security for their own infrastructure, or perhaps they were confident in the obscurity of the panel's location. Either way, it provides a convenient command-and-control interface for managing compromised systems across the hospitality sector.
Defending Against CaptiveCrunch: Security Practices for 2026
Microsoft's recommendations for defending against this campaign are straightforward but critical:
Network-level defenses:
- Treat hotel and conference Wi-Fi as inherently untrusted
- Use private cellular connections or managed corporate networks whenever possible
- Avoid software updates or tools offered through captive portals
Authentication hardening:
- Adopt phishing-resistant authentication with MFA and passkeys
- Disable Microsoft Entra device code authentication when not needed
- Avoid using corporate credentials to register for guest Wi-Fi networks
These practices align with broader cybersecurity best practices for securing AI agent environments and protecting against nation-state cyber operations. The key insight here is that traditional endpoint security isn't enough—organizations need to think about network-level controls, authentication hardening, and user education.
Why This Matters for AI Cybersecurity in 2026
The CaptiveCrunch campaign is significant for several reasons that extend beyond the immediate technical details:
First, it demonstrates how nation-state threat actors are targeting the most vulnerable points in an organization's security posture—shared hospitality infrastructure. Hotels and conference centers are inherently untrusted environments, yet organizations continue to expect employees to work through them without additional safeguards.
Second, the use of AI tools in malware development is a trend that's likely to accelerate. As AI cybersecurity tools become more sophisticated, threat actors are responding in kind, leveraging the same technology to create more effective attacks. This arms race between defensive and offensive AI capabilities is a defining feature of the 2026 threat landscape.
Third, the campaign highlights the importance of defense-in-depth. No single security control will stop CaptiveCrunch. Organizations need network monitoring, endpoint detection, authentication hardening, and user awareness programs working together to provide comprehensive protection.
For security teams, the takeaway is clear: treat all public Wi-Fi as hostile, enforce phishing-resistant authentication, and assume that any guest network connection is potentially compromised. It's not paranoia—it's the reality of operating in 2026's threat environment.
