The Wi-Fi login page in a hotel lobby is the least suspicious screen a traveller sees all day. Microsoft has just published what happens when that page belongs to Russian intelligence: a campaign it calls CaptiveCrunch, running since early May 2026, in which captive portals in hotels and conference venues are used to reroute guests through attacker infrastructure and push malware disguised as an ordinary browser update.
Who is behind it
Microsoft Threat Intelligence attributes the operation to Storm-2945, a new subgroup of Midnight Blizzard, the actor also tracked as APT29 or Cozy Bear and attributed by the US and UK governments to Russia's foreign intelligence service, the SVR. The targets are business travellers: hospitality networks in several countries, chosen because that is where the useful laptops connect.
How the attack works
The chain is short and it never requires a vulnerability in your device:
- The portal is the man in the middle. Once the hotel network is compromised, the captive portal manipulates DNS and HTTP traffic and sends guests through infrastructure the attackers control.
- The bait is an update. Instead of the usual "you are connected" page, the guest gets a convincing prompt to install a browser or system update, in the ClickFix style that asks the user to run a command or script themselves.
- Two payloads follow. CornFlake is a Go-based Windows remote access tool with keylogging, clipboard monitoring, screenshots, audio and video capture, browser credential theft and a remote shell. ChocoShell is a PowerShell stealer that runs in memory and takes browser cookies, saved passwords, Microsoft 365 single sign-on tokens and Wi-Fi credentials.
The Microsoft 365 tokens are the point. With a valid session token an attacker does not need your password and does not trigger a second factor: they simply continue your session from their own machine.
Why the usual advice fails here
"Check for the padlock" does not help, because the phishing page is served over HTTPS with its own valid certificate. "Do not download from strange sites" does not help either, because the update prompt appears on the page you were expected to see. The attacker owns the first hop of the network, which is the one place where nothing on your laptop can vouch for what it is talking to.
What Microsoft recommends
- Prefer private connectivity over public Wi-Fi whenever practical: a phone hotspot or an enterprise-managed travel router.
- Never install updates offered by a captive portal, and never paste commands it suggests.
- Use passwordless sign-in and phishing-resistant MFA, and block device code flow where the organisation can.
Where a VPN actually helps, and where it does not
A tunnel raised before you open a browser removes the attacker's leverage over DNS and HTTP: your queries resolve inside the tunnel and the portal no longer decides what your requests reach. That is the specific failure this campaign relies on, and it is the one an encrypted tunnel closes.
The order matters more than the brand. The captive portal has to be passed first, which is the window in which the manipulation happens, so the safest sequence is to connect, accept nothing, raise the tunnel, and only then start working. And no tunnel helps after the fact: if you ran the "update", the malware is on the machine and traffic encryption is irrelevant.
