SVR Operatives Are Turning Hotel Wi-Fi Into Malware Traps
Think twice before connecting to the Wi-Fi at your next conference. Microsoft has published research linking Storm-2945, a unit operating under the SVR's Midnight Blizzard umbrella (the same crew behind the SolarWinds compromise), to an ongoing campaign targeting captive portal networks at hotels, conference centres, and similar venues.
The operation, which Microsoft has named CaptiveCrunch, began around February 2026 with traffic manipulation activity observed from early May. How the group initially gets into these networks remains unclear, but once they're in, the picture isn't pretty.
With control of the network layer, Storm-2945 tampers with DNS and HTTP traffic to route victims through attacker-controlled infrastructure. They also abuse the routine connectivity checks that operating systems perform when joining a new network, hijacking those to serve malicious prompts. Classic adversary-in-the-middle stuff, just wearing a particularly convincing disguise.
The prompts themselves follow the ClickFix playbook: fake OS update screens, driver repair notifications, web verification failures. Users who click through end up with malware on their machines.
The primary payload is CornFlake, a full-featured Windows remote access trojan written in Go. It presents a convincing fake Windows update progress window while quietly installing itself. Once resident, it offers the attacker a fairly comprehensive toolkit: keylogging, clipboard monitoring, screenshots, audio and video capture, browser credential theft, file exfiltration, USB drive monitoring, remote shell access, and a security posture sweep of the infected machine.
CornFlake also exposes a local HTTP API that turns it into a modular platform, capable of pulling down additional payloads. The one Microsoft highlights is ChocoShell, a PowerShell-based infostealer that runs entirely in memory. Its job is straightforward: hoover up browser session cookies, saved passwords, SSO tokens, and Wi-Fi credentials.
Microsoft's own summary puts it plainly: CornFlake provides a persistent long-running foothold, while ChocoShell extracts the credentials that actually matter operationally. They work as a pair.
Most of the activity targets Windows machines, though Microsoft has also spotted ClickFix prompts crafted for Android, nudging users to sideload an APK.
There's a second strand to CaptiveCrunch beyond the malware: device code phishing. Victims redirected to attacker-controlled landing pages are instructed to enter a device code on a legitimate Microsoft authentication page. The device code OAuth flow was designed for devices that can't easily open a browser, like smart TVs. Attackers abuse it by requesting the code themselves, sending it to the victim, and waiting for the victim to complete the authentication on their behalf. The victim thinks they're logging in. They're actually handing over a valid OAuth token for their Microsoft 365 account.
Device code phishing isn't new. Microsoft noted it has been observing Midnight Blizzard using the technique since August 2024. What's interesting here is the combination: using a compromised captive portal to serve the phishing page makes the whole flow feel more plausible to the target. The AitM position does a lot of work.
As for mitigation, Microsoft stops short of telling people to never use hotel Wi-Fi, but recommends favouring personal hotspots or satellite connections where possible. On the user side: don't install software prompted by a public network, learn what ClickFix attacks look like, and don't trust unexpected authentication prompts.
For organisations, the more impactful step is disabling the device code authentication flow entirely wherever it isn't needed. Passwordless authentication can block many phishing approaches, but device code phishing can sidestep even passkeys in some configurations. Killing the flow at the policy level removes the attack surface altogether. That's the cleanest fix available right now.