Russian spies turn public Wi-Fi into malware delivery systems

1. Executive summary

Microsoft Threat Intelligence has disclosed "CaptiveCrunch," an ongoing campaign attributed to Storm-2945, a sub-cluster of the Midnight Blizzard group (also known as APT29, MITRE G0016). The operation compromises captive-portal Wi-Fi networks at hospitality venues worldwide to manipulate DNS and HTTP traffic, creating an adversary-in-the-middle (AitM) position that delivers malware via ClickFix-style fake update prompts and conducts device code phishing against Microsoft Entra ID. The campaign delivers a Go-based Windows RAT called CornFlake (persistent foothold) and an in-memory PowerShell infostealer called ChocoShell (credential and token theft), alongside a previously unseen C2 panel named FruitStone. EMEA financial services staff travelling for business are directly exposed; successful intrusions yield persistent device compromise and OAuth token theft that can bypass MFA and grant access to Microsoft 365 cloud environments.

2. Regulatory framing

No specific DORA article on third-party risk is engaged here: the captive-portal networks are hospitality infrastructure, not ICT third-party providers under contract.

3. Technical analysis & attack chain

Attribution note: Microsoft attributes CaptiveCrunch to Storm-2945, described as a sub-cluster of Midnight Blizzard. Midnight Blizzard is widely identified with APT29 (MITRE G0016). However, "Storm-2945" has no MITRE ATT&CK profile in the verified reference data — attribution to this specific sub-cluster should be treated as unconfirmed beyond Microsoft's single-source assessment. "Nobellium" and "SVR" also appear in reporting but lack MITRE profiles in the verified data; the SVR linkage is an assessment, not a confirmed attribution.

Attack chain (confirmed steps from source material)

1. Captive portal network compromise (initial access — method unknown). Storm-2945 gains control of the network layer at hospitality venues (hotels, conference centres, shared venues). Microsoft's investigation into the initial compromise vector is ongoing. However, Microsoft has observed "notable commonalities in the equipment and management systems used across multiple affected networks," suggesting the activity may reflect access to shared services within the captive portal ecosystem rather than isolated per-venue compromises. (Single-sourced to Microsoft; no vendor has corroborated the shared-service hypothesis.)
2. DNS and HTTP traffic manipulation. Once network-layer control is established, the attackers manipulate DNS and HTTP traffic to reroute users through attacker-controlled infrastructure. This is active since early May 2026; the broader AI-assisted operation dates to February 2026.
3. Connectivity check abuse and ClickFix delivery. The attackers abuse operating system connectivity checks to trigger malicious prompts and redirects. Users are presented with ClickFix-style prompts disguised as OS updates, driver repairs, or web verification failures. The prompts instruct users to download and execute malware. Android-device variants have also been observed, instructing users to download and install an APK file.
4. Malware execution — CornFlake RAT. CornFlake is a full-featured Windows RAT written in Go (compiled Golang). It presents a fake Windows update progress window during installation. Capabilities include: keylogging, clipboard monitoring, screenshot capture, audio surveillance, video surveillance, browser credential theft, file exfiltration, USB drive monitoring, security posture sweep, and remote shell. CornFlake exposes a localhost HTTP API server that transforms the implant into a modular platform for delivering additional payloads. It is described as the SVR's go-to persistent implant in these hospitality network attacks.
5. In-memory payload — ChocoShell (also referenced as "CocoShell" in Risky Business News — discrepancy noted). ChocoShell is a PowerShell-based infostealer delivered and executed entirely in-memory. It harvests browser session cookies, saved passwords, SSO tokens, and Wi-Fi credentials. Microsoft's summary: "Where CornFlake provides the operator with a persistent, long-running foothold on the device, ChocoShell is designed to extract the most operationally valuable credentials, giving the operator access to victim cloud environments." (Note: Risky Business News refers to this payload as "CocoShell" — this may be a transcription variant or a distinct strain; the Microsoft primary source uses "ChocoShell.")
6. Command and control — FruitStone. Both CornFlake and ChocoShell communicate with FruitStone, described as a never-before-seen C2 panel. No further technical detail on FruitStone's protocol or infrastructure is provided in the source material.
7. Device code phishing (parallel attack path). A portion of CaptiveCrunch activity targets Microsoft Entra ID via device code phishing. The AitM position redirects users to attacker-controlled landing pages (doppelganger domains mimicking Microsoft online services). The attacker requests a device code from Microsoft, presents it to the victim on the fake landing page, and instructs the victim to enter the code on a legitimate Microsoft authentication page. When the victim selects an account and completes authentication, the attacker receives a valid OAuth token for the victim's Microsoft 365 account. This bypasses MFA. Microsoft notes this is "consistent with previously reported device code phishing operations conducted by Midnight Blizzard since August 2024."
8. AI augmentation. Microsoft states Storm-2945 "leveraged AI to support a significant portion of these operations" and that the operation is "AI-augmented." No further detail on how AI was used is provided. Anthropic and OpenAI are credited as collaborators in the investigation, implying their platforms were used by the threat actor and detected.

Observed impact: Widespread compromise of Wi-Fi networks at hospitality organisations and other captive-portal-serviced networks across several countries. ReliaQuest assesses the goal is access to victim cloud environments and credentials.

4. Mitigation & containment

P1 — Within 24 hours

• Disable device code authentication flow in Microsoft Entra ID wherever operationally feasible. This is the single most effective control against the OAuth token theft path in this campaign. In Entra ID, this is configured via the "Authentication methods" policy — disable the "Device code flow" for all users who do not require it (e.g., smart TV / IoT device scenarios).
• Issue travel security advisory to all staff: Do not download OS updates, driver repairs, or browser updates while connected to public/hospitality Wi-Fi. Do not enter device codes presented on non-Microsoft pages. Use personal hotspots or satellite connections in preference to venue Wi-Fi.
• Block known ClickFix delivery patterns at web gateway / proxy: flag or block pages that present fake "verification failed" or "update required" prompts with instructions to run PowerShell or download executables.

P2 — Within 72 hours

• Deploy EDR detection content for CornFlake and ChocoShell behaviours (see §6 for detection rules): focus on Go-compiled binaries presenting fake Windows update windows, localhost HTTP API binding, in-memory PowerShell execution harvesting browser credential stores, and USB device monitoring activity.
• Review Entra ID sign-in logs for device code flow authentication events since February 2026 — filter for authenticationProtocol = deviceCode and correlate with impossible-travel or anomalous IP geolocation. Revoke any suspicious OAuth tokens.
• Review conditional access policies to restrict token issuance from untrusted locations; require compliant device status for M365 access from non-corporate networks.

P3 — Within 7 days

• Implement passwordless authentication (FIDO2 / passkeys) for M365 access. Microsoft notes this thwarts many phishing techniques, though device code phishing may bypass even passkeys — therefore this is defence-in-depth, not a standalone solution.
• Conduct retrospective review of travelling staff endpoint telemetry since February 2026 for indicators of CornFlake/ChocoShell execution (Go binary with fake update window, in-memory PowerShell, localhost HTTP API).
• Update security awareness training to include ClickFix attack patterns and device code phishing scenarios specific to travel contexts.
• Engage hospitality/captive-portal vendors if your organisation operates conference or event venues — request information on whether their captive portal equipment or management systems are affected by the shared-service compromise described by Microsoft.

5. Indicators of compromise

No atomic indicators (IPs, domains, hashes, file paths, registry keys) are present in the provided source material. Microsoft and ReliaQuest have not published specific IOCs in the referenced articles.

Behavioural indicators

6. Detection

rule CornFlake_RAT_Go_Implant {
  meta:
    author = "Adverse Trace"
    date = "2026-08-03"
    reference = "https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/"
    description = "Detects CornFlake RAT — Go-compiled Windows implant with localhost HTTP API, fake Windows update window, keylogging and surveillance capabilities"
  strings:
    $go_buildid = "Go build ID:" ascii
    $localhost_api = "127.0.0.1" ascii
    $update_window = "Windows Update" wide ascii
    $update_progress = "update progress" wide ascii nocase
    $keylog_func = "keylog" ascii nocase
    $clipboard = "clipboard" ascii nocase
    $screenshot = "screenshot" ascii nocase
    $audio_surv = "audio" ascii nocase
    $video_surv = "video" ascii nocase
    $usb_mon = "usb" ascii nocase
    $remote_shell = "remote shell" ascii nocase
    $exfil = "exfil" ascii nocase
  condition:
    $go_buildid and ($update_window or $update_progress) and 4 of ($keylog_func, $clipboard, $screenshot, $audio_surv, $video_surv, $usb_mon, $remote_shell, $exfil, $localhost_api)
}

rule ChocoShell_PowerShell_Infostealer {
  meta:
    author = "Adverse Trace"
    date = "2026-08-03"
    reference = "https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/"
    description = "Detects ChocoShell in-memory PowerShell infostealer — targets browser session cookies, saved passwords, SSO tokens, Wi-Fi credentials"
  strings:
    $cookie = "session cookie" ascii nocase
    $saved_pw = "saved password" ascii nocase
    $sso_token = "SSO token" ascii nocase
    $wifi_cred = "Wi-Fi credential" ascii nocase
    $browser_steal = "browser" ascii nocase
    $chocoshell = "ChocoShell" ascii nocase
  condition:
    $chocoshell or (3 of ($cookie, $saved_pw, $sso_token, $wifi_cred, $browser_steal))
}

title: CornFlake RAT — Go Binary with Localhost HTTP API and Fake Windows Update Window
id: 7a3c1f2e-8b4d-4a6e-9c5f-1d2e3f4a5b6c
status: experimental
description: Detects Go-compiled process displaying a Windows Update progress window and binding a localhost HTTP API server, consistent with CornFlake RAT
author: Adverse Trace
date: 2026/08/03
references:

  - https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/
logsource:
  product: windows
  category: process_creation
detection:
  selection_go_process:
    Image|endswith:

      - '.exe'
    CommandLine|contains:

      - 'Go build'
  filter_legitimate_go:
    Image|startswith:

      - 'C:\Program Files\Go\'
      - 'C:\Go\'
  condition: selection_go_process and not filter_legitimate_go
falsepositives:

  - Legitimate Go applications displaying update windows
level: medium

title: Suspicious Device Code Flow Authentication in Entra ID
id: 8b4d2e3f-9c5a-4b7f-ad6e-2e3f4a5b6c7d
status: experimental
description: Detects device code flow authentication events in Entra ID that may indicate CaptiveCrunch device code phishing
author: Adverse Trace
date: 2026/08/03
references:

  - https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/
logsource:
  product: azure
  service: signinlogs
detection:
  selection:
    authenticationProtocol: deviceCode
  filter_expected:
    Location|contains:

      - 'Expected Corporate Location'
  condition: selection and not filter_expected
falsepositives:

  - Legitimate device code authentication from IoT devices, smart TVs, or constrained devices
level: high

Threat actor context

APT29 · G0016 · aka IRON RITUAL, IRON HEMLOCK, NobleBaron, Dark Halo, NOBELIUM

APT29 is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR). They have operated since at least 2008, often targeting government networks in Europe and NATO member countries, research institutes, and think tanks. APT29 reportedly compromised the Democratic National Committee starting in the summer of 2015. …

No MITRE ATT&CK profile for: Storm-2945, Nobellium, SVR.

7. Sources

• Microsoft Threat Intelligence, "CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft," https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/, 2026-07-31
• The Register, "Russian spies turn public Wi-Fi into malware delivery systems," https://www.theregister.com/security/2026/08/03/russias-svr-borks-public-wi-fis-for-digital-surveillance/5282399, 2026-08-03
• Risky Business News, "Risky Bulletin: Russia is behind the recent hotel WiFi hacks," https://news.risky.biz/risky-bulletin-russia-is-behind-the-recent-hotel-wifi-hacks/, 2026-08

8. Adverse Trace position

This is a high-severity campaign for EMEA financial services organisations with travelling staff. The combination of network-layer AitM, social engineering via ClickFix, and device code phishing creates a multi-stage attack that can bypass MFA and yield both persistent endpoint compromise and cloud account takeover. The attribution to Storm-2945 / Midnight Blizzard is single-sourced to Microsoft; the sub-cluster designation lacks independent MITRE ATT&CK corroboration, and the SVR linkage is an assessment rather than confirmed attribution. No atomic IOCs have been published — detection must rely on behavioural and log-based approaches. The most urgent client action is disabling the device code authentication flow in Entra ID and issuing immediate travel security guidance. We will monitor for IOC publication from Microsoft, ReliaQuest, or third-party researchers and issue a supplemental advisory if actionable indicators emerge. We assess that the shared captive-portal infrastructure hypothesis, if confirmed, significantly expands the attack surface beyond individual venue risk — this warrants attention from any organisation operating or contracting with conference and hospitality venues.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.