APT29 Hijacks Hotel Wi-Fi to Deliver CornFlake Surveillance RAT

A fake browser update served over hijacked hotel Wi-Fi networks has been used to deliver CornFlake, a Go-based remote access trojan (RAT) capable of capturing webcam images, microphone audio, and keystrokes. Microsoft tracks the operation as CaptiveCrunch and attributes it to Storm-2945, which it assesses as an operational sub-cluster of Midnight Blizzard, also known as APT29 and Cozy Bear. The U.S. and U.K. governments attribute the broader actor to Russia's Foreign Intelligence Service (SVR).

According to ReliaQuest's investigation, the attackers compromised captive portal gateways that also functioned as the DNS resolver for connected devices. With administrative control of the gateway, they forged DNS responses to redirect automatic connectivity checks into fake browser or operating system update prompts. Some pages employed ClickFix social engineering, instructing victims to open a terminal or Windows utility and execute an attacker-supplied command. Microsoft has observed this traffic manipulation since early May across hospitality networks in multiple countries, though it has not publicly named any hotel, venue, or captive portal vendor. ReliaQuest recommends an always-on, full-tunnel VPN that routes DNS queries through corporate resolvers before the venue gateway can respond, and travelers should reject any updates, certificates, or security utilities offered through captive portals. You can verify your connection's exposure with a DNS leak test and check whether your traffic is being proxied through an unexpected gateway using the VPN/proxy detector.

Since July 16, some CaptiveCrunch landing pages have redirected guests into Microsoft's legitimate device code authentication flow. Entering the attacker-supplied code on Microsoft's genuine sign-in page can grant the attacker-controlled session multi-factor authentication (MFA)-satisfied access to Microsoft 365 and Azure Active Directory accounts. Microsoft recommends blocking this flow through Conditional Access policies wherever it is not operationally required.

The CornFlake implant copies itself to %APPDATA%\svchost32\svchost32.exe and registers a persistence service under the display name "Cloud Sync Service," while a fake progress window keeps the victim's attention. Microsoft's analysis shows it can capture idle-triggered screenshots, record clipboard contents with the active window title, steal browser cookies and saved passwords (including those protected by Chrome App-Bound Encryption), scan removable media, and open a remote shell. It establishes persistence via a Registry Run key and a scheduled task, with a watchdog that restores any mechanism defenders attempt to remove. Researchers also identified ChocoShell, an in-memory PowerShell stealer that harvests Microsoft 365 and Azure AD access tokens, refresh tokens, and Web Account Manager (WAM) tokens from .tbres files. Given the implant's password theft capabilities, users should run any saved credentials through a password checker and rotate any passwords used while connected to compromised networks.