Midnight Blizzard Hijacks Hotel Wi-Fi Portals to Steal Microsoft 365 Credentials

Microsoft Threat Intelligence and Zscaler reported that Storm-2945, a sub-cluster of Midnight Blizzard / APT29 linked to Russia, has been compromising shared captive-portal infrastructure at hotels, conference centers, and similar venues to intercept traveler traffic and steal Microsoft 365 credentials. The operation, dubbed CaptiveCrunch, manipulates DNS and HTTP flows to redirect victims from legitimate Wi-Fi login pages to attacker-controlled phishing and malware-delivery sites, including lures for Microsoft Entra ID device code phishing and ClickFix-style fake updates. Activity has been observed in multiple U.S. cities as well as India and Saudi Arabia, indicating a broad campaign aimed at travelers across sectors.

Researchers said the campaign deploys multiple payloads after credential theft, including CornFlake, a Go-based Windows RAT used for persistence and surveillance, and ChocoShell, an in-memory PowerShell stealer designed to collect browser secrets, Microsoft 365 and Azure AD/WAM tokens, and Wi-Fi credentials. The operation has also expanded to Android through malicious APKs, and Microsoft assessed that AI-assisted tooling supported parts of the intrusion set, including development of CornFlake and ChocoShell. The reporting indicates the attackers are using trusted hospitality network infrastructure as an initial access vector to harvest identities and extend compromise onto victim devices.