Russian spies transform public Wi-Fi into malware distribution systems
Microsoft reveals Russia's SVR hacking public Wi-Fi networks to spread spyware through fake updates.
1Russian intelligence's new operation
Microsoft disclosed that Russia's Foreign Intelligence Service (SVR)-linked Storm-2945 group is targeting public Wi-Fi networks. The group compromises networks at hotels and conference centers, redirecting users to malware. The operation, ongoing since February 2026, has involved traffic manipulation since early May. Attackers gain network layer control to redirect users through their infrastructure.
2Malware distribution techniques
Attackers abuse operating systems' connectivity checks to display fake warnings. Using ClickFix-style methods, they convince users to install malware disguised as OS updates or driver repairs. These primarily target Windows users, but specially crafted APK files for Android devices were also detected. Microsoft named this campaign 'CaptiveCrunch'.
3CornFlake: Advanced spyware
SVR's CornFlake, a 'full-featured Windows RAT' written in Go, provides persistent access to victim devices. It tricks users with fake Windows update windows, then offers extensive capabilities including keylogging, screen capture, audio/video surveillance, and browser credential theft. CornFlake also operates as a modular platform, delivering additional payloads like ChocoShell.
4Credential theft with ChocoShell
The PowerShell-based ChocoShell is a memory-resident infostealer that harvests browser session cookies, saved passwords, SSO tokens, and Wi-Fi credentials. Microsoft explains CornFlake maintains persistent access while ChocoShell steals operationally valuable credentials, granting attackers access to victims' cloud environments.
5Device code phishing method
Part of SVR's CaptiveCrunch operation involves device code phishing. Attackers redirect victims to fake landing pages prompting them to enter device codes on legitimate Microsoft authentication pages, unknowingly authorizing attacker sessions. This OAuth flow abuse aims to bypass MFA. Microsoft confirmed this technique has been used since August 2024.
6Public Wi-Fi risks
Microsoft warns users against trusting public Wi-Fi networks, particularly in hotels and conference centers. Personal hotspots or satellite internet connections are recommended as safer alternatives. Emphasizing user education, Microsoft advises against downloading updates over public networks or responding to fake prompts.
7Organizational countermeasures
Passwordless authentication stands out among technical measures organizations can implement, though device code phishing can bypass even passkeys. The most effective solution is disabling device code authentication flows where possible, preventing employees from surrendering workplace cloud access to attackers. Microsoft recommends proactive defenses against such attacks.
8Cybersecurity experts warn
Experts warn that sophisticated state-sponsored cyber operations like this will increase. Both public Wi-Fi users and organizations need to review security measures. Traveling executives and employees with sensitive data access face particularly high risks. Microsoft's technical details provide valuable resources for security teams updating defense strategies.