Microsoft linked a global campaign called CaptiveCrunch to the Russian APT group Midnight Blizzard (APT29), targeting hotel and conference Wi-Fi networks worldwide. The attackers manipulate DNS settings on captive portal devices to intercept user connections and redirect victims to phishing pages mimicking Microsoft 365 login portals or device code phishing pages abusing Microsoft Entra ID authentication flows. Additionally, fake browser and OS update pages deliver malware via ClickFix prompts. Two malware families were identified: CornFlake, a Go-based RAT with capabilities including remote shell, keylogging, credential theft, and surveillance; and ChocoShell, a PowerShell credential stealer targeting browser cookies, passwords, Microsoft 365 and Azure AD tokens, and Wi-Fi credentials. The malware uses multiple persistence mechanisms and disguises itself as legitimate Windows components. An exposed web management panel named FruitStone was used by the attackers to control infected systems. Microsoft advises avoiding captive portal updates, using private or cellular connections, enabling phishing-resistant MFA, and disabling unnecessary device code authentication.

The campaign enables attackers to gain persistent remote access to infected Windows systems, steal Microsoft 365 credentials and session tokens, browser cookies, saved passwords, and Wi-Fi credentials, and conduct surveillance via keylogging, screenshots, microphone, and webcam capture. This compromises user accounts and sensitive data, potentially leading to unauthorized access to corporate resources. The manipulation of DNS and HTTP traffic on hospitality Wi-Fi networks facilitates large-scale credential theft and malware deployment. The presence of a web-based management panel allows attackers to control infected hosts extensively.

Microsoft recommends treating hotel and conference Wi-Fi networks as untrusted environments. Use private cellular or managed network connections whenever possible. Avoid installing software updates or tools offered through captive portals. Adopt phishing-resistant authentication methods such as multi-factor authentication (MFA) and passkeys. Disable Microsoft Entra device code authentication if it is not required. Avoid using corporate credentials on guest Wi-Fi networks. There is no vendor advisory indicating an official patch; therefore, follow these mitigation steps to reduce risk.