CaptiveCrunch: the hotel Wi-Fi as a collection point
A Russian state cyber-espionage cluster has been taking administrative control of hotel Wi-Fi, forging the answers the network gives to guests' laptops, and using that position to serve fake update prompts that install a remote access trojan and steal authentication tokens.
The target is not the hotel. It is the traveller - and specifically the government, diplomatic and corporate traveller who has to connect to something when they arrive.
↓ Download one-page brief (PDF)The guest connects, and the network answers
A captive portal is the page that intercepts a device when it joins a public network. On the networks examined, that same gateway was also the DNS resolver - the service that turns a name into an address. Whoever controls it controls what the device is told.
The connectivity check is redirected
Every laptop quietly checks whether it really has internet access when it joins a network. With forged DNS answers, that automatic check can be pointed at attacker-controlled content instead, without the user typing anything or clicking a link.
A convincing update prompt
The guest is shown what appears to be a browser or operating-system update. Microsoft describes CornFlake operating first as a dropper, displaying a fake progress window - one build option shows a Windows Update screen reading "Working on updates" - while it copies itself into place.
Persistence disguised as a normal service
The implant registers as a Windows service using a name and description chosen to resemble ordinary cloud synchronisation software, so that a glance at the running services list shows nothing unusual.
Collection, and the move to accounts
CornFlake is a full-featured remote access trojan with data collection and anti-detection capabilities. Alongside it, the campaign abuses the device-code authentication flow in Microsoft Entra ID through look-alike domains mimicking Microsoft online services, taking the operation from one laptop to the accounts behind it.
Forest Blizzard router hijacking
Microsoft disclosed a separate Russian DNS hijacking operation in April 2026. It notes the similarity in technique while attributing CaptiveCrunch to Storm-2945 rather than to that actor.
ReliaQuest reports part of the activity
Doppelganger domains mimicking Microsoft online services, used for follow-on adversary-in-the-middle phishing that abuses the Entra ID device-code flow.
Microsoft publishes CaptiveCrunch
The traffic manipulation, the CornFlake implant and the campaign infrastructure are set out in full.
The technique is not new, and that is the point worth carrying. Hostile-state exploitation of untrusted public and hotel Wi-Fi against travelling officials has been a documented concern for years. What has changed is industrialisation: this is the same idea run at the DNS level, across the hospitality sector, with purpose-built malware and a management console behind it.
The user did nothing wrong, and that is the design
There is no phishing email to spot and no link to avoid. The victim joins a hotel network and accepts what looks like a routine update. Any control that depends on the traveller behaving well has already been bypassed, which is the same conclusion as the half-click exploitation in the Exchange campaign and points the same way: technical controls, not awareness alone.
Attribution is layered, and the layers carry different weight
Two separate claims sit inside this case and should not be collapsed into one. That APT29 is almost certainly part of the SVR is a government attribution, held by the NCSC and partners. That this particular campaign belongs to a sub-cluster of that actor is Microsoft's assessment, and public reporting notes no independent technical corroboration of that link. The first is firmer than the second.
The initial compromise is unexplained
How the gateways were taken in the first place has not been established. ReliaQuest holds, with low to medium confidence, that exposed management interfaces and weak or reused administrator credentials may have provided access, while noting that visibility constraints prevented confirmation. Until that is resolved, no venue can be confident it is not affected.
Travel is the exposure, and it is predictable
The population at risk is defined by behaviour rather than seniority: whoever travels, stays in hotels and attends conferences. Those movements are often published in advance, which makes the targeting straightforward - the same principle as the public naming of the target at Damietta, applied to people rather than infrastructure.
The requirement is durable and the method is cheap
A compromised gateway serves every guest who connects. It is almost certain that Russian state actors continue to target travelling officials and executives through the networks they depend on abroad, and likely that untrusted public Wi-Fi remains a preferred route for as long as organisations permit direct connection to it.
At Akrotiri a person is accused of standing outside a base and watching it. Here the adversary owns the network your staff connect to the moment they land. Both are collection against people who are simply doing their jobs - but this one scales to every guest in the building, and asks nothing of them but arrival.
- Require a VPN before anything else on any network you do not control. A tunnel established before general traffic flows removes the value of controlling the local resolver. This is the single most effective measure available against this technique.
- Prefer a mobile hotspot to hotel Wi-Fi for travelling staff. Cellular tethering avoids the captive portal entirely, and the cost is trivial against the exposure.
- Tell staff that software updates are never delivered by a hotel network. A prompt to update a browser or operating system immediately after connecting is the signature here, and it is a simple, memorable rule.
- Treat session tokens as credentials in incident response. Revoking sessions and tokens is a separate action from resetting a password, and this campaign turns on exactly that distinction.
- Scrutinise device-code authentication. The Entra ID device-code flow is abused here; restrict or monitor it, and alert on sign-ins that use it from unexpected locations.
- Build travel into the security brief, not just the expenses policy. Where people are going, when, and what they carry are protective-security questions for any organisation whose staff travel to conferences or negotiations.
- https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/
- https://thehackernews.com/2026/08/hijacked-hotel-wi-fi-pushes-fake.html
- https://www.microsoft.com/en/security/security-insider/midnight-blizzard
Compiled from open-source reporting for professional security discussion. Attribution of this campaign to Storm-2945 is Microsoft's, and public reporting notes that no separate technical report has independently corroborated the link; the attribution of the broader APT29 actor to Russia's SVR is held by the UK and US governments. Details may be revised as investigation continues. This is a protective-security lessons-learned assessment, not an operational account, and is not a substitute for vendor guidance.