[TIMESTAMP: 2026-08-04 01:28 UTC] [AUTHOR: Runtime Rebel Intel] [SEVERITY: MEDIUM]

Hotel Wi-Fi Campaigns Use CornFlake and ChocoShell Malware

MEDIUM Threat Intel #Credential Theft #Phishing #Malware

READ_TIME: 3 min read

This article was written by a language model from the source above and was not reviewed by a human before publication. Verify anything operational against the original. Editorial policy

// executive briefing tl;dr

[01] Immediate impact: Travelers and conference attendees risk credential theft and account compromise via hijacked hotel and conference center Wi-Fi networks.
[02] Affected systems: Microsoft 365 accounts, Microsoft Entra ID authentication flows, Windows endpoints, and Android devices.
[03] Remediation: Treat hotel and conference Wi-Fi as untrusted, use cellular connections, and enforce phishing-resistant MFA.

Overview of CaptiveCrunch Campaign

Microsoft has linked a global campaign targeting hospitality Wi-Fi networks to the Russian threat actor APT29, also tracked as Midnight Blizzard and Storm-2945. According to BleepingComputer, the activity—designated as CaptiveCrunch—has been active since at least early May, though device and OAuth code phishing operations began as early as February. The campaign abuses captive portal equipment in hotels and conference centers to manipulate DNS and HTTP traffic, allowing operators to intercept user connections.

While initial access vectors remain undetermined, researchers noted signs of compromise affecting shared network infrastructure rather than isolated endpoints. Security teams investigating these incidents should review how to detect hotel Wi-Fi malware campaigns by monitoring anomalous DNS modifications and unexpected captive portal redirection behaviors across roaming endpoints.

Technical Analysis of CornFlake and ChocoShell

During the campaign, the threat actor deploys custom tooling designed for persistence, credential harvesting, and surveillance. Microsoft identified two primary malware families used in these attacks:

CornFlake: A Go-based remote access trojan (RAT) that displays a bogus progress window to distract users while copying the binary to the %AppData% directory. It disguises itself as a legitimate component named “Cloud Sync Service” and uses multiple persistence vectors, including registry run keys, scheduled tasks, and a watchdog routine.
ChocoShell: An in-memory PowerShell credential stealer that harvests browser cookies, saved passwords, Wi-Fi credentials, and Microsoft 365 or Azure AD tokens.

Furthermore, code analysis suggests that artificial intelligence tools were likely used to develop these payloads. Operators manage infected systems using an unprotected web-based management panel known as FruitStone, which enables file browsing, command execution, and screenshot capture.

Delivery Mechanisms

Attackers utilize multiple methods after intercepting network traffic:

Redirecting victims to credential harvesting pages impersonating Microsoft 365 login portals.
Abusing Microsoft Entra ID device code authentication flows.
Deploying fake browser or operating system update pages that deliver Windows malware via ClickFix prompts, alongside Android APK payloads.

Mitigation and Defense Strategies

Defenders must assume that public guest networks are hostile environments. Organizations should implement strict travel security guidelines to protect corporate identities from interception:

Network Isolation: Mandate that employees avoid hotel and conference Wi-Fi, preferring private cellular connections or enterprise-managed virtual private networks.
Authentication Hardening: Enforce phishing-resistant multi-factor authentication, such as hardware security keys and passkeys, while disabling unused Microsoft Entra device code authentication flows.
User Awareness: Educate staff to reject software updates, browser installers, or verification prompts encountered through captive portal landing pages.

#Credential Theft #Phishing #Malware

X/Twitter LinkedIn Reddit HN

← Back to Articles