Hotel Wi-Fi is the SVR's new espionage front door

Every business traveler knows the ritual: connect to the hotel network, accept the terms, get online. Microsoft Threat Intelligence says a group tied to Russia's Foreign Intelligence Service has spent months turning that ritual into an attack surface.

Since early May 2026, the group tracked as Storm-2945 and assessed to be a sub-cluster of the SVR-linked actor Midnight Blizzard has been manipulating DNS and HTTP traffic on captive portal networks at hospitality venues in several countries. Microsoft calls the operation CaptiveCrunch. ReliaQuest, which reported on part of the activity on July 23, has seen it at hotels, conference centers and shared venues, and assesses that the goal is access to the accounts of corporate travelers.

Hotel Wi-Fi as an espionage front door

The campaign runs in two phases. Since February 2026, Storm-2945 has carried out AI-augmented device code and OAuth code phishing operations that led to Entra device registration and data collection from Microsoft 365. That fits a wider trend documented in this analysis of AI-powered phishing. Since early May, the operator has been compromising the captive portal networks themselves, redirecting user traffic through actor-controlled infrastructure.

Microsoft's investigation into how the portal networks were first breached is ongoing. Commonalities in equipment and management systems across affected networks point to access to shared services in the captive portal ecosystem rather than isolated venue-by-venue intrusions.

From portal to payload: the attack chain

The attack works because it sits exactly where travelers stop questioning the network. When a device joins a captive portal network, the browser runs automated connectivity checks against known endpoints. Storm-2945 answers those checks with malware disguised as browser or operating system updates, delivered through ClickFix landings that pressure the user into downloading and executing the file. Microsoft has also seen indications the group may target Android devices, with landings instructing users to install an APK.

Part of the campaign abuses the device code flow in Microsoft Entra ID. Since July 16, some landing pages have pointed users to enter a device code into a legitimate Microsoft sign-in page: the victim authenticates the attacker's session instead of their own. As reported by ReliaQuest, the landings rely on doppelganger domains such as ms365-live[.]com that mimic Microsoft online services. OAuth token theft has a track record beyond this group; ToddyCat has automated the same trick against Gmail, using its Umbrij malware. The difference here is placement: a traveler inside a hotel portal is more likely to treat an authentication prompt as routine.

CornFlake and ChocoShell: the malware behind the campaign

Two tools do most of the work. CornFlake is a full-featured Windows remote access trojan written in Go, the campaign's primary persistent implant. Go is also the language of another Microsoft-documented backdoor, GigaWiper, which bundles three wiper families into one implant. On first execution CornFlake shows a fake progress window, configurable at build time to resemble a Windows Update, a security scan or a DirectX installer, while it copies itself to %APPDATA%\svchost32\svchost32.exe and registers a Windows service named svchost32 with the display name "Cloud Sync Service". Persistence is layered: service registration, Registry Run keys, scheduled tasks and a watchdog that restores any mechanism defenders remove.

Once installed, CornFlake becomes a full surveillance toolkit: keylogging, clipboard capture, screenshots, audio and webcam recording, browser credential theft through a ChromeKatz-derived module that bypasses Chrome's App-Bound Encryption, file exfiltration, USB monitoring and a remote shell. Its command-and-control uses ECDH P-256 ephemeral key exchange, so each session carries a unique key and captured traffic cannot be decrypted without it.

ChocoShell is the in-memory PowerShell infostealer. It disables AMSI via .NET reflection, checks for sandboxes, and escalates privileges through three silent UAC bypass techniques before falling back to a visible prompt. From an elevated position it locks Defender signature updates and harvests browser cookies, Microsoft 365 SSO tokens, Web Account Manager tokens and Wi-Fi credentials.

The code comments are the most revealing detail. Microsoft notes ChocoShell was written with full developer comments explaining the intent behind each code decision, including references to Microsoft detection signatures. The consistent style suggests AI-assisted code generation. Microsoft observed Storm-2945 leveraging AI across a significant portion of its operations, and thanked Anthropic and OpenAI for their collaboration. This is not a hypothetical use of AI in an attack chain: Sysdig has documented the first fully AI-run ransomware attack.

Storm-2945: an evolution, not an anomaly

Microsoft assesses Storm-2945 as an operational sub-cluster of Midnight Blizzard based on overlaps with Storm-2372, the sub-cluster tracked through 2025 for device code and OAuth code phishing, Graph-based email exfiltration and social engineering via commercial messaging apps. Midnight Blizzard is attributed by the US and UK governments to the SVR, and primarily targets governments, diplomatic entities, NGOs and IT providers, mostly in the US and Europe.

Device code phishing by Midnight Blizzard has been documented since August 2024. What changed in CaptiveCrunch is delivery: the captive portal gives the operator a genuine in-the-middle position, and traffic manipulation makes fake update and sign-in prompts look native to the environment. Automation is becoming a normal part of that delivery, as shown when an autonomous agent broke into Hugging Face's data pipeline, an incident described as a blueprint for the next era of cybersecurity.

Microsoft's guidance to enterprises is blunt. Treat hotel, conference and airport networks as untrustworthy, prefer mobile hotspots and eSIM connections, use passkeys and multifactor authentication, block device code flow where possible, and never reuse corporate credentials on venue registration pages.