Russian State-Sponsored Hackers Exploit Hotel Wi-Fi to Steal Microsoft 365 Credentials Using Custom Malware

Microsoft has officially attributed a sophisticated global cyber-espionage campaign, dubbed "CaptiveCrunch," to the Russian state-sponsored threat actor known as Midnight Blizzard, also tracked by the cybersecurity community as APT29 or Nobelium. This extensive operation leverages compromised hospitality Wi-Fi networks to infiltrate Microsoft 365 accounts through a multi-stage attack chain involving custom malware and deceptive phishing tactics. The findings, corroborated by earlier reports from cybersecurity firm ReliaQuest, paint a concerning picture of targeted attacks against travelers and business professionals utilizing public and semi-public internet access points.

The campaign, believed to have been active since at least early May 2026, with initial phishing operations targeting device and OAuth code flows dating back to February, demonstrates a significant evolution in the tactics, techniques, and procedures (TTPs) employed by Midnight Blizzard. This actor, notorious for its involvement in high-profile breaches, including the SolarWinds attack, has now honed its methods to exploit the inherent vulnerabilities of unsecured network environments, particularly those found in hotels and conference centers.

The CaptiveCrunch Attack Chain: A Multi-Layered Deception

At the core of the CaptiveCrunch operation lies the manipulation of network traffic. Attackers gain access to captive portal equipment, the gateway systems that manage user authentication for Wi-Fi networks. By altering the Domain Name System (DNS) settings on these devices, they can intercept and redirect user traffic. This redirection is crucial for presenting victims with malicious content, disguised as legitimate login pages or software update prompts.

While the precise initial compromise vector for these captive portal devices remains elusive to both Microsoft and ReliaQuest, initial indicators suggest a focus on shared infrastructure rather than isolated device breaches. This implies a broader, more strategic approach to gaining access to a wider pool of potential victims.

Once a user connects to the compromised Wi-Fi, the attackers can deploy several malicious strategies:

• Microsoft 365 Credential Phishing: Victims are directed to highly convincing phishing pages that impersonate Microsoft 365 login portals. The goal is to trick users into entering their corporate credentials, including usernames and passwords.
• Device Code Phishing: Leveraging Microsoft Entra ID (formerly Azure AD) authentication flows, attackers present users with device code phishing pages. This tactic exploits legitimate authentication mechanisms to steal tokens and session information, granting access to cloud-based resources. Microsoft observed this specific method becoming more prevalent around July 2026.
• Malware Delivery via Fake Updates: A particularly insidious tactic, not previously detailed, involves presenting users with fake browser or operating system update pages. These deceptive pages prompt users to download and install what they believe to be legitimate updates. However, these downloads are in fact custom malware. The campaign utilizes "ClickFix" prompts, designed to appear as user verification steps, to facilitate the execution of these malicious payloads on Windows systems.

Microsoft’s investigation also uncovered evidence suggesting that the threat actor is extending its reach to Android devices. In some instances of the ClickFix landing pages, evidence indicated the delivery of an Android Package Kit (APK) file, signaling an intent to compromise mobile devices connected to these networks as well.

Introducing CornFlake and ChocoShell: The Malware Arsenal

Microsoft researchers have detailed two novel malware families discovered within the CaptiveCrunch campaign: CornFlake and ChocoShell. These tools are designed to provide persistent access, facilitate credential theft, enable surveillance, and exfiltrate sensitive data.

CornFlake: The Persistent Access Trojan

CornFlake is a Go-based Remote Access Trojan (RAT) offering a suite of capabilities for maintaining a foothold on compromised systems. Upon execution, it presents a deceptive progress window to distract the user, masking the binary’s discreet copy to the %AppData% directory, a common location for legitimate application data, to establish persistence.

The visual deception employed by CornFlake is highly sophisticated. The fake progress window can be configured to mimic various common system interfaces, including:

• Windows update screens
• Microsoft Defender virus scans
• Disk optimization utilities
• Network diagnostic tools
• Browser update prompts
• Document viewer installers

This chameleon-like ability to blend in with legitimate system activities significantly lowers the likelihood of immediate detection by unsuspecting users.

To ensure long-term presence, CornFlake employs multiple persistence mechanisms:

• Windows Service Registrations: Creating or hijacking Windows services to ensure the malware runs automatically at system startup.
• Registry Run Keys: Modifying registry entries that are executed when a user logs in.
• Scheduled Tasks: Creating tasks that are executed at predefined intervals or triggers.
• Watchdog Routine: A self-healing mechanism designed to detect and restore any disabled persistence methods, making removal significantly more challenging.

The malware disguises itself under the name "Cloud Sync Service," aiming to appear as a benign and legitimate component of the Windows operating system.

ChocoShell: The In-Memory Credential Stealer

ChocoShell is a more focused, in-memory PowerShell-based credential stealer. Its primary function is to extract sensitive information directly from the victim’s system without writing extensively to disk, making it harder for traditional file-based antivirus solutions to detect.

ChocoShell targets a wide range of credentials, including:

• Browser cookies, which can contain session tokens and authentication information for various websites.
• Saved passwords stored by web browsers.
• Microsoft 365 and Azure AD tokens, granting access to cloud services and sensitive corporate data.
• Wi-Fi credentials, potentially allowing the attacker to pivot to other networks.

The extensive comments found within the ChocoShell code suggest a significant reliance on AI tools during its development. Microsoft’s analysis indicates that AI may have been employed to assist in code generation, debugging, or even architectural design, reflecting a growing trend in sophisticated malware development.

The FruitStone Management Panel

Further enhancing the operational efficiency of the threat actor, Microsoft researchers discovered an unprotected web-based management panel named "FruitStone." This panel serves as a centralized command-and-control (C2) interface for the attackers, allowing them to:

• Manage and monitor infected systems remotely.
• Browse files and directories on victim machines.
• Execute arbitrary PowerShell commands, providing deep control over the compromised environment.
• Capture screenshots and keystrokes for surveillance and intelligence gathering.

The existence of such a dedicated management panel underscores the organized and professional nature of Midnight Blizzard’s operations.

Background and Timeline of Activity

The attribution of CaptiveCrunch to Midnight Blizzard (APT29) is significant due to the actor’s history and capabilities. This group has been consistently linked to Russian intelligence agencies and has demonstrated a persistent interest in gaining long-term access to governments and organizations worldwide. Their strategic focus often involves espionage and intelligence gathering rather than purely financial gain.

While the CaptiveCrunch campaign itself is believed to have ramped up in early May 2026, the underlying phishing operations targeting device and OAuth code flows have been ongoing since at least February 2026. This suggests a prolonged period of reconnaissance and preparation before the full-scale deployment of the captive portal attack vector.

ReliaQuest’s initial disclosure in early August 2026 detailed the DNS hijacking aspect, highlighting the ingenuity of redirecting users to malicious sites. Microsoft’s subsequent analysis, released on July 31, 2026, provided a deeper dive into the malware families, the broader attack chain including malware delivery, and the official attribution to Midnight Blizzard.

Broader Impact and Implications

The CaptiveCrunch campaign has far-reaching implications for individuals and organizations alike:

• Increased Risk for Travelers: Professionals who frequently travel for business are particularly vulnerable. Their reliance on hotel and conference Wi-Fi networks makes them prime targets for credential theft and subsequent corporate network breaches.
• Erosion of Trust in Public Wi-Fi: This campaign further erodes trust in the security of public Wi-Fi networks, which are often considered a convenience rather than a security risk. The sophisticated nature of these attacks demonstrates that even seemingly innocuous connections can be compromised.
• Sophistication of State-Sponsored Actors: The use of custom malware, AI-assisted development, and multi-stage attack chains highlights the advanced capabilities and persistent threat posed by state-sponsored cyber actors. Their willingness to invest resources in developing novel techniques underscores the evolving landscape of cyber warfare.
• Cloud Security Challenges: The targeting of Microsoft 365 and Azure AD credentials emphasizes the critical need for robust cloud security measures. As more organizations migrate to cloud-based services, the security of these platforms becomes paramount.
• AI in Cybercrime: The indication that AI tools were used in malware development is a significant trend. This suggests that AI could lower the barrier to entry for creating sophisticated malware, potentially leading to an increase in the volume and complexity of cyber threats.

Mitigation and Recommendations

Microsoft has provided several key recommendations for users and organizations to mitigate the risks associated with campaigns like CaptiveCrunch:

• Treat Public Wi-Fi as Untrusted: Users should always assume that public Wi-Fi networks, especially in hotels and conference centers, are compromised or can be compromised.
• Utilize Secure Alternatives: Whenever possible, opt for private cellular connections or managed, secure corporate VPNs for sensitive activities.
• Avoid Captive Portal Interactions: Refrain from downloading software updates or accepting tools offered through captive portal interfaces, as these are common infection vectors.
• Implement Phishing-Resistant Authentication: Organizations should prioritize phishing-resistant multi-factor authentication (MFA) methods, such as FIDO2 security keys and passkeys, to significantly reduce the risk of credential compromise.
• Disable Unnecessary Authentication Flows: For organizations using Microsoft Entra ID, it is recommended to disable device code authentication when it is not actively required for legitimate business operations.
• Strict Credential Policy: Advise users against using corporate credentials to register for guest Wi-Fi networks, as this can create an easy pathway for attackers to gain initial access to internal systems.

The ongoing efforts by cybersecurity researchers and vendors like Microsoft are crucial in identifying and exposing such sophisticated threats. However, the continuous evolution of attack methodologies by actors like Midnight Blizzard necessitates a proactive and multi-layered approach to cybersecurity for both individuals and organizations to stay ahead of emerging risks. The CaptiveCrunch campaign serves as a stark reminder that vigilance and robust security practices are essential in today’s interconnected world.