- Published on
Hijacked Hotel Wi-Fi Pushes Fake Updates to Deliver Surveillance Malware
- Authors
- Name
- DeepHorus
Hijacked hotel Wi-Fi networks are being used to deliver surveillance malware under the guise of fake browser updates, Microsoft warned in a new report. The campaign, tracked as CaptiveCrunch, has been active since early May across hospitality networks in multiple countries. It deploys a remote access trojan called CornFlake that can capture webcam images, audio, keystrokes, and more. Microsoft attributes the operation to Storm-2945, a sub-cluster of the Russian-backed group Midnight Blizzard, also known as APT29 or Cozy Bear. U.S. and U.K. authorities link the broader group to Russia's Foreign Intelligence Service (SVR). The attacks appear to target high-value travelers, possibly for espionage. The attack flow starts when a device connects to a hotel's guest internet. The captive portal gateway also acts as a DNS resolver, and attackers who control it can forge DNS responses. This lets them redirect a laptop's automatic connectivity check to a fake browser or OS update page. Some pages give ClickFix instructions that trick victims into running commands, though the user must still execute the payload. CornFlake, a Go-based implant, installs itself as Cloud Sync Service and can take screenshots, log keystrokes, steal browser cookies and saved passwords, and open a remote shell. It also copies itself to %APPDATA%\svchost32\svchost32.exe and uses persistence mechanisms that regenerate if removed. A second tool, ChocoShell, harvests Microsoft 365 and Azure Active Directory tokens from the Token Broker cache, enabling session replay attacks. ReliaQuest, which investigated the campaign, says the tradecraft resembles APT28, another Russian group, but stopped short of attributing it. Microsoft found common equipment across affected networks, suggesting a shared compromise in the captive portal ecosystem. Neither vendor named the hotels or providers involved. Researchers recommend travelers use a full-tunnel VPN, which routes DNS queries through corporate resolvers before the venue's gateway can answer. They also advise rejecting any software updates, certificates, or troubleshooting tools offered over hotel Wi-Fi. Microsoft suggests blocking device code authentication flows unless required, since some pages redirect victims into Microsoft's sign-in flow with attacker-provided codes. The full scale of the compromise remains unclear, as Microsoft has not reported how many devices were infected or accounts stolen. The campaign highlights the risk of unmanaged guest networks in hotels and the need for robust endpoint controls. For now, travelers should treat hotel internet as hostile and assume any update prompt could be malicious.
