Microsoft Links CaptiveCrunch Hotel Wi-Fi Campaign to APT29
Summary
Microsoft attributes CaptiveCrunch, which targets hotel and conference Wi-Fi, to Midnight Blizzard (APT29). It describes DNS tampering, phishing, and malware used to steal credentials and maintain access, and recommends safer connections and phishing-resistant MFA.
Key points
- Microsoft attributes CaptiveCrunch to Midnight Blizzard, also tracked as APT29 and Storm-2945; it says activity has been underway since at least May.
- The campaign manipulates DNS and HTTP traffic on captive-portal Wi-Fi to redirect users to Microsoft 365 and device-code phishing pages.
- Fake browser or operating-system update pages use ClickFix prompts to deliver malware; Microsoft also observed evidence of APK delivery targeting Android devices.
- CornFlake is a Go-based RAT with remote access, surveillance, credential theft, and file-exfiltration capabilities. It uses multiple persistence methods on Windows.
- ChocoShell is an in-memory PowerShell credential stealer targeting browser data, Microsoft 365 and Azure AD tokens, and Wi-Fi credentials.
- Microsoft found an unprotected FruitStone panel used to manage infected systems and access files, run commands, capture screenshots, and record keystrokes.
- Microsoft recommends treating guest Wi-Fi as untrusted, avoiding captive-portal downloads, using phishing-resistant authentication, and disabling device-code authentication when unnecessary.
Article Details
- Event Type
- Microsoft-attributed cyber campaign, named CaptiveCrunch, targeting hotel and conference Wi-Fi networks through DNS and HTTP manipulation, phishing, and malware delivery.
- Impact
- The activity targets Microsoft 365 accounts and can steal browser credentials, cookies, and authentication tokens. CornFlake and ChocoShell provide persistent access, surveillance, credential theft, and data-exfiltration capabilities. Microsoft reported signs of breaches in shared infrastructure but could not determine the exact initial compromise; it also found indications that some campaign landings target Android devices.
MITRE ATT&CK
T1053.005 · Scheduled TaskCornFlake uses named tasks for persistence.T1056.001 · KeyloggingCornFlake supports keylogging, and FruitStone can capture keystrokes.T1059.001 · PowerShellChocoShell is an in-memory PowerShell credential stealer, and the FruitStone panel was used to execute PowerShell commands.T1113 · Screen CaptureCornFlake supports screenshot capture, and FruitStone can capture screenshots.T1528 · Steal Application Access TokenThe campaign steals Microsoft 365 and Azure AD tokens.T1539 · Steal Web Session CookieChocoShell steals browser cookies.T1543.003 · Windows ServiceCornFlake uses Windows service registrations for persistence.T1547.001 · Registry Run Keys / Startup FolderCornFlake uses registry run keys for persistence.T1555.003 · Credentials from Web BrowsersChocoShell steals saved browser passwords.T1566.002 · Spearphishing LinkThe campaign used phishing pages, including pages impersonating Microsoft 365 login portals.
Threat Actors
ICE RELICThe article identifies APT29 as another tracking name for Midnight Blizzard, which Microsoft attributed to the CaptiveCrunch campaign.Midnight BlizzardMicrosoft attributed the CaptiveCrunch campaign targeting hospitality Wi-Fi networks to Midnight Blizzard.Storm-2945Microsoft tracked the campaign activity as Storm-2945 and described it as a sub-cluster of Midnight Blizzard.
Malware
ChocoShellThe campaign uses the CornFlake and ChocoShell malware families, along with the FruitStone panel, to maintain access, collect credentials, and exfiltrate data.CornFlakeThe campaign uses the CornFlake and ChocoShell malware families, along with the FruitStone panel, to maintain access, collect credentials, and exfiltrate data.
Vendors
Products
Azure ADChocoShell steals browser cookies, passwords, Microsoft 365 tokens, Azure AD tokens, and Wi-Fi credentials.Microsoft 365 Apps for EnterpriseMicrosoft linked the CaptiveCrunch campaign to Midnight Blizzard (APT29), saying it targets hotel and conference Wi-Fi networks to steal Microsoft 365 accounts through DNS tampering, phishing, and malware delivery.Microsoft Entra IDAfter modifying DNS settings, the attacker can redirect victims to phishing pages that impersonate Microsoft 365 login portals, or to device code phishing pages that abuse Microsoft Entra ID authentication flows.Microsoft WindowsCornFlake provides remote access, surveillance, credential theft, and persistence on Windows systems.