Russian Hackers Hijack Hotel Wi-Fi to Steal Microsoft 365 Tokens
Sophisticated cyberattack campaign targets travelers' credentials through compromised hospitality networks worldwide.
1Threat Spread Through Hotel Wi-Fi Networks
Microsoft revealed that Russia-linked hacker group Storm-2945 has been targeting Wi-Fi networks at hotels, conference centers, and shared spaces since May 2026. By manipulating DNS and HTTP traffic, they redirect users to malicious pages containing malware. The campaign specifically aims to compromise corporate travelers' Microsoft 365 accounts through credential theft.
2CornFlake: Stealthy Windows Malware
The attacks deploy CornFlake, a fully-featured Windows RAT (Remote Access Trojan) written in Go. Disguised as 'Cloud Sync Service', it mimics legitimate svchost.exe processes. It establishes persistence through Windows service registrations, Registry Run keys, and scheduled tasks. Even when security measures remove it, the malware automatically reactivates itself through watchdog routines.
3Advanced Data Exfiltration Capabilities
CornFlake can log keystrokes, capture screenshots and webcam feeds, steal browser credentials, and monitor USB devices for file exfiltration. It uses ECDH P-256 key exchange for encrypted command and control channels. Each session employs unique ephemeral keys, making intercepted traffic impossible to decrypt without the specific private key.
4ChocoShell: Memory-Resident Infostealer
The second component, ChocoShell, is a PowerShell-based credential stealer that operates entirely in memory. It harvests Microsoft 365, Azure AD access tokens, and WAM tokens from Token Broker cache files. These tokens allow attackers to replay SSO sessions without browser cookies. The tool also implements three silent UAC bypass techniques and disables Windows Defender signature updates.
5Device Code Phishing Technique
Since July 16th, attackers added a new technique: redirecting victims to Microsoft's legitimate device code authentication flow. Users unwittingly authenticate the attacker's session by entering the displayed code. Since users complete MFA themselves, this grants attackers multi-factor authenticated sessions without needing to bypass security measures directly.
6FruitStone: Centralized C2 Panel
Storm-2945 operators manage the CaptiveCrunch campaign through FruitStone, a web-based control panel disguised as 'CloudSync Console'. This centralized interface allows control of CornFlake implants, payload deployment, stolen data collection, and compromised device management. It streamlines operations across multiple infected devices simultaneously.
7Widespread Global Impact
Microsoft confirmed widespread compromise of hospitality Wi-Fi networks across multiple countries. ReliaQuest analysis shows attacks occurring not just at hotels but also conference centers and other shared venues. Shared infrastructure patterns suggest access to portions of the captive portal ecosystem rather than individual venue breaches.
8Enterprise Security Recommendations
Microsoft advises organizations to block device code flows via Conditional Access policies where not explicitly required. For traveling employees, VPN usage, encrypted network traffic, and regular MFA token revocation are critical precautions. Users should exercise extreme caution when authenticating on public Wi-Fi networks during business travel.