Hotel Wi-Fi Hijacking Delivers Surveillance Malware
Microsoft reports CornFlake spyware spreading through fake updates on compromised hotel networks.
1Capabilities of CornFlake Spyware
Microsoft's report details CornFlake RAT (Remote Access Trojan) spreading via fake browser updates on hijacked hotel Wi-Fi networks. The malware can capture webcam images, microphone audio, and keystrokes. CornFlake copies itself to the %APPDATA% directory, registering as a system service named 'Cloud Sync Service'. It can steal Chrome's encrypted cookies and provides remote shell access, demonstrating advanced surveillance capabilities.
2Attack Technical Details
Attackers gain administrative control over hotel captive portal gateways to manipulate DNS responses. This redirects devices' automatic connectivity checks to fake update servers. Some victims are instructed to open terminals and execute specific commands. Microsoft has observed these traffic manipulations since May 2024 across hospitality networks in multiple countries, indicating a widespread campaign.
3Attribution and Threat Actors
Microsoft attributes the CaptiveCrunch operation to Storm-2945, a subgroup of Midnight Blizzard (APT29), which is linked to Russia's Foreign Intelligence Service (SVR). The UK National Cyber Security Centre confirms APT29's likely affiliation with SVR. However, the connection between CaptiveCrunch and Storm-2945 currently relies solely on Microsoft's analysis, lacking independent technical corroboration.
4New Authentication Bypass Technique
Since July 16, some CaptiveCrunch pages redirect victims to Microsoft's device code authentication flow. Entering attacker-provided codes can bypass multi-factor authentication (MFA). Microsoft recommends blocking this flow via Conditional Access where unnecessary. This technique resembles the Forest Blizzard router hijacking disclosed in April, showing evolving adversary tactics against authentication systems.
5Secondary Malware: ChocoShell
Researchers identified ChocoShell, an in-memory PowerShell-based data stealer. It harvests Microsoft 365, Azure AD access tokens, refresh tokens, and WAM tokens from .tbres files in the Token Broker cache. These stolen tokens enable session replay attacks without requiring browser cookies, demonstrating sophisticated credential theft capabilities that bypass typical security controls.
6Industry Impact and Defense Recommendations
ReliaQuest documented attackers using identical Microsoft-impersonating domains and overlapping infrastructure. While techniques resemble those of GRU-linked APT28 (Fancy Bear), definitive attribution remains uncertain. Enterprises should mandate always-on full-tunnel VPNs with corporate DNS resolvers. Individual travelers should reject software updates, certificates, or security tools offered through captive portals to mitigate risks.
7Potential Initial Compromise Vector
While the initial access method remains under investigation, ReliaQuest assesses with medium confidence that exposed management interfaces combined with weak/reused admin credentials may have provided entry. Microsoft found common equipment across affected networks, suggesting access to portions of the captive portal ecosystem. This implies compromises might not be limited to individual venues, potentially affecting multiple providers.
8Why This Matters
This operation poses significant risks for traveling executives and corporate employees. Attackers targeting captive portal infrastructure demonstrate how single vulnerabilities can impact multiple locations. Despite Microsoft's warnings, affected providers remain unnamed. Such sophisticated attacks necessitate reevaluation of public Wi-Fi security policies, especially for organizations with mobile workforces in the hospitality sector.
Original article: The Hacker News — Otel Wi-Fi'ları Üzerinden Yayılan Casus Yazılım Tehdidi