Russian Hackers Exploit Hotel Wi-Fi to Steal Microsoft 365 Credentials

Midnight Blizzard, a Russian threat actor associated with the country's foreign intelligence service, has been actively targeting users of public Wi-Fi networks in hotels and conference centers. Microsoft Threat Intelligence recently reported on this campaign, dubbed CaptiveCrunch, which has been ongoing since February 2026. The operation employs two malware strains, CornFlake and ChocoShell, to manipulate traffic and facilitate credential theft.

The attackers exploit captive portal networks by manipulating DNS and HTTP traffic, redirecting victims to phishing pages that impersonate Microsoft 365 sign-in portals and device code phishing pages that misuse Microsoft Entra ID authentication. Additionally, they present fake browser or operating system update prompts to trick users into downloading malware.

CornFlake is described as a Windows remote access trojan (RAT) written in Go, capable of establishing persistence on infected devices. Upon execution, it displays a fake progress window to distract users while it installs itself in the system. ChocoShell, on the other hand, is an in-memory PowerShell credential stealer that targets sensitive information such as browser cookies, saved passwords, and Microsoft 365 credentials.

Microsoft's investigation indicates that the CaptiveCrunch operation may not be limited to isolated incidents, as there are notable similarities in the equipment and management systems across affected networks. This suggests a broader access to shared services within the captive portal ecosystem.

The researchers also discovered a web-based command and control panel, named FruitStone, used by the Storm-2945 operators to manage compromised endpoints and deploy new payloads. This panel operates without authentication, allowing for easy access to collected data, including screenshots and keystrokes.

In light of these findings, Microsoft advises users to treat hotel and conference Wi-Fi networks as untrusted. They recommend using private cellular connections or managed networks when possible and to avoid software updates or tools offered through captive portals. Organizations should also be cautious about the information shared with hospitality providers when connecting to guest networks, as public infrastructure may not be secure.