Full Report
A fake browser update served over hijacked hotel Wi-Fi has been used to deliver CornFlake, a remote access trojan (RAT) that can capture webcam images, microphone audio, and keystrokes, Microsoft said in its latest report. Researchers track the operation as CaptiveCrunch and attribute it to Storm-2945. It assesses Storm-2945 to be an operational sub-cluster of Midnight Blizzard, also known as
Analysis Summary
# Incident Report: Project CaptiveCrunch - Midnight Blizzard Hospitality Hijack
## Executive Summary
Russian state-sponsored actor Storm-2945 (Midnight Blizzard/APT29) hijacked hotel Wi-Fi captive portals and DNS resolvers to deliver the "CornFlake" RAT via fake browser updates. The campaign focused on surveillance and credential theft, utilizing DNS poisoning to redirect travelers to malicious landing pages. The operation successfully bypassed MFA in some instances using device code authentication phishing.
## Incident Details
- **Discovery Date:** July 2026 (ReliaQuest report published July 24; Microsoft report August 1)
- **Incident Date:** Early May 2026 – Ongoing
- **Affected Organization:** Multiple undisclosed hotels and hospitality venues
- **Sector:** Hospitality / Travel
- **Geography:** International (Several countries)
## Timeline of Events
### Initial Access
- **Date/Time:** Early May 2026
- **Vector:** Hijacked Captive Portal / DNS Poisoning
- **Details:** Attackers gained administrative control over hotel gateway equipment. They forged DNS responses to redirect "connectivity check" traffic from guest laptops to malicious update pages.
### Lateral Movement
- **Technique:** Movement within the victim's environment was facilitated by stealing M365 and Azure AD access/refresh tokens using the "ChocoShell" stealer to bypass traditional login requirements.
### Data Exfiltration/Impact
- **Details:** Exfiltration of browser cookies (including Chrome App-Bound encrypted cookies), saved passwords, clipboard data, and keystrokes. Multimedia capture included webcam images and microphone audio.
### Detection & Response
- **How it was discovered:** Threat research by ReliaQuest and Microsoft identifying overlapping infrastructure with known APT groups.
- **Response actions taken:** Microsoft issued guidance on blocking device code authentication flows and published indicators to help organizations hunt for the CornFlake implant.
## Attack Methodology
- **Initial Access:** DNS hijacking via compromised captive portal gateways; ClickFix social engineering.
- **Persistence:** Windows Service (Cloud Sync Service), Registry Run keys, and Scheduled Tasks; protected by a "watchdog" process that restores deleted persistence.
- **Privilege Escalation:** Not explicitly detailed, but uses service registration for elevated execution.
- **Defense Evasion:** Use of Go-based implants (CornFlake), in-memory PowerShell stealers (ChocoShell), and masquerading as "svchost32.exe" or "Cloud Sync Service."
- **Credential Access:** Theft of M365/Azure AD tokens (WAM tokens) from `.tbres` files; stealing browser cookies and passwords.
- **Discovery:** Scanning for removable media; monitoring active window titles.
- **Lateral Movement:** Session replay using stolen refresh tokens and device code authentication flow exploitation.
- **Collection:** Keystroke logging, clipboard monitoring, webcam/microphone capture, and screenshotting.
- **Exfiltration:** Remote shell capabilities and automated data upload to C2.
- **Impact:** Full surveillance and account takeover of high-value travelers.
## Impact Assessment
- **Financial:** Not disclosed; high potential for corporate espionage costs.
- **Data Breach:** Compromise of corporate credentials, session tokens, and sensitive private communications (audio/video).
- **Operational:** Disruption of secure remote work for business travelers.
- **Reputational:** Significant impact on the perceived security of hotel Wi-Fi and captive portal providers.
## Indicators of Compromise
- **Network indicators:** Attacker-controlled DNS resolvers and phishing domains impersonating Microsoft (e.g., `microsoft-updates[.]com` - *example defanged*).
- **File indicators:**
- `%APPDATA%\svchost32\svchost32.exe`
- Token Broker cache files (`.tbres`)
- **Behavioral indicators:** Unauthorized registry modifications in Run keys; new service "Cloud Sync Service" with "svchost32" binary.
## Response Actions
- **Containment:** Blocking the Microsoft device code authentication flow via Conditional Access.
- **Eradication:** Terminating the svchost32.exe process and its watchdog; deleting the associated service and scheduled tasks.
- **Recovery:** Revoking all active M365/Azure sessions and forcing password resets/MFA re-enrollment for affected users.
## Lessons Learned
- **Key Takeaways:** Hospitality Wi-Fi remains a high-risk vector for targeted espionage.
- **Weaknesses:** Reliance on local DNS resolvers and captive portals creates a single point of failure for travelers. The "Device Code" flow is an increasingly popular vector for bypassing MFA.
## Recommendations
- **VPN:** Implement "Always-on," full-tunnel VPNs to ensure DNS queries are resolved via secure corporate servers rather than local gateways.
- **Conditional Access:** Disable Device Code Flow in Microsoft Entra ID unless specifically required for headless devices.
- **User Education:** Train staff to never accept software updates or run terminal commands prompted by a public Wi-Fi portal.
- **EDR/AV:** Deploy endpoint protection capable of detecting suspicious Go-based binaries and unauthorized Token Broker cache access.