Hacked Hotel Wi-Fi Pushes Fake Updates Carrying a Spyware Trojan

In a new report, Microsoft has described a campaign in which attackers hand out fake browser updates over hacked hotel Wi-Fi. The end result is the installation of the CornFlake remote-access trojan, which can capture the feed from a webcam, audio from a microphone and keystrokes. The operation is tracked under the name CaptiveCrunch and attributed to the group Storm-2945, which Microsoft assesses as an operational subcluster of Midnight Blizzard (APT29, Cozy Bear). The United States and the United Kingdom link this group to Russia's Foreign Intelligence Service.

How the hijack works

According to ReliaQuest, in the compromised networks the captive-portal gateway doubled as the DNS resolver for connected devices. Having gained control of the gateway, the attackers forged DNS responses and redirected traffic — for example, a laptop's automatic connectivity check to a page with a fake browser or OS update. Some of the pages use the ClickFix technique: the victim is prompted to open a terminal and run a command that has been slipped to them. Crucially, the gateway only steers the user — no infection happens without their involvement: the person has to download and launch the payload themselves.

Microsoft has been recording traffic manipulation since the beginning of May in hotel networks across several countries, but names neither the hotels nor the portal vendors. Since July 16, some pages have begun redirecting guests into Microsoft's device code authentication flow: entering the supplied code on the genuine sign-in page hands the attacker a session that has already cleared multi-factor authentication.

What CornFlake can do

The implant is written in Go, copies itself to %APPDATA%\svchost32\svchost32.exe and registers a service under the name Cloud Sync Service, distracting the victim with a fake progress window. It takes screenshots while the machine is idle, reads the clipboard, steals cookies and saved browser passwords (including those protected by Chrome's App-Bound Encryption), scans removable media and opens a remote shell. A separate “watchdog” restores the persistence mechanisms if they are removed. Researchers also found ChocoShell — an in-memory PowerShell stealer for Microsoft 365 and Azure AD tokens.

How widespread this is

The reports document the fact of redirection and malware delivery, but do not measure the scale: there are no figures for successful launches, approved codes or hijacked accounts, so it is impossible to judge how often a redirect actually turned into a compromise. Microsoft notes shared hardware and management systems in the affected networks — this may point to access to shared services within part of the portal ecosystem, meaning the incidents may not have been isolated.

Attribution remains contested. ReliaQuest saw similarities to the hallmarks of APT28 (Fancy Bear) but stopped short of firm conclusions, and the CaptiveCrunch–Storm-2945 link has not yet been confirmed by any independent technical report. The initial intrusion vector is still being studied: exposed management interfaces and weak administrator passwords are suspected with low-to-medium confidence.

Experts advise travelers to keep a full-tunnel VPN switched on and to decline any updates, certificates or utilities offered through a captive portal.

Source: The Hacker News