Microsoft Details CaptiveCrunch Hotel Wi-Fi Malware and Token Theft
Summary
Microsoft says CaptiveCrunch hijacked hotel Wi-Fi captive portals to redirect users to fake updates delivering CornFlake RAT; related device-code phishing and ChocoShell token theft targeted Microsoft 365 and Azure AD. Successful compromise scale is unknown.
Key points
- Microsoft observed traffic manipulation since early May across hospitality networks in several countries; it has not named affected venues or captive-portal providers.
- ReliaQuest found that compromised gateways also acted as DNS resolvers, allowing attackers with administrative control to forge DNS answers and redirect device connectivity checks.
- The redirects led to fake browser or operating-system updates. Some used ClickFix instructions, but victims still had to download or execute the payload; the gateway did not silently infect endpoints.
- CornFlake can capture screenshots, webcam images, microphone audio, keystrokes, clipboard contents, browser cookies and saved passwords, and can open a remote shell. It also uses multiple persistence mechanisms, with a watchdog that can restore removed ones.
- Since July 16, some landing pages have led to Microsoft device-code authentication; entering an attacker-supplied code can grant an attacker-controlled session MFA-satisfied access. Microsoft recommends blocking the flow through Conditional Access where it is not needed.
- ChocoShell, an in-memory PowerShell stealer, collects Microsoft 365 and Azure AD tokens from the Token Broker cache; stolen tokens may enable session replay without a browser cookie.
- Microsoft attributes CaptiveCrunch to Storm-2945, but that assessment has not been independently corroborated publicly. The initial access method and the scale of successful executions, approvals, or account theft remain unknown.
Article Details
- Attack Vectors
- Attackers with administrative control of compromised hotel Wi-Fi captive portal gateways forged DNS answers and redirected connectivity checks to fake browser or operating-system update pages.
- Some landing pages used ClickFix instructions to persuade victims to open a terminal or Windows utility and run an attacker-supplied command; infection required the victim to download or execute the payload.
- Since July 16, some CaptiveCrunch landing pages redirected guests into Microsoft’s device code authentication flow, where entering an attacker-supplied code could grant an attacker-controlled session MFA-satisfied access.
- ChocoShell collected Microsoft 365 and Azure AD access, refresh, and WAM tokens from .tbres files in the Token Broker cache.
- Defensive Notes
- ReliaQuest recommends an always-on, full-tunnel VPN so DNS queries go through corporate resolvers before a venue gateway can answer them.
- Microsoft recommends blocking device code authentication through Conditional Access wherever the flow is not needed.
- Researchers advise travelers to use private connections and reject software updates, certificates, browser updates, troubleshooting tools, or security utilities offered through captive portals.
MITRE ATT&CK
T1053.005 · Scheduled TaskCornFlake used a scheduled task for persistence.T1056.001 · KeyloggingCornFlake could capture keystrokes.T1059.001 · PowerShellClickFix instructions told victims to run an attacker-supplied command in a terminal or Windows utility; ChocoShell is described as an in-memory PowerShell stealer.T1113 · Screen CaptureCornFlake could take screenshots, including idle-triggered screenshots.T1115 · Clipboard DataCornFlake could record clipboard contents along with the active window title.T1123 · Audio CaptureCornFlake could record microphone audio.T1125 · Video CaptureCornFlake could capture webcam images.T1204.002 · Malicious FileThe fake update did not silently infect endpoints; victims had to download or execute the delivered payload.T1528 · Steal Application Access TokenChocoShell collected Microsoft 365 and Azure AD access, refresh, and WAM tokens from the Token Broker cache.T1539 · Steal Web Session CookieCornFlake could steal browser cookies, including cookies protected by Chrome App-Bound Encryption.T1547.001 · Registry Run Keys / Startup FolderCornFlake used a Registry Run key for persistence.T1550.001 · Application Access TokenThe article says stolen tokens could enable session replay without a browser cookie.T1555.003 · Credentials from Web BrowsersCornFlake could steal saved browser passwords.
Threat Actors
APT28ReliaQuest said CaptiveCrunch tradecraft resembled APT28 activity but stopped short of attribution, citing TTP overlap rather than direct technical linkage. The article also identifies APT28 with the names Fancy Bear and Forest Blizzard.Cozy BearMicrosoft assesses Storm-2945, which it attributes to CaptiveCrunch, to be an operational sub-cluster of the group also known as Cozy Bear; the article identifies that group as Midnight Blizzard and APT29.Fancy BearThe article identifies Fancy Bear as another name for APT28, whose tradecraft ReliaQuest said CaptiveCrunch resembled; ReliaQuest did not attribute CaptiveCrunch to APT28.ICE RELICMicrosoft assesses Storm-2945, which it attributes to CaptiveCrunch, to be an operational sub-cluster of APT29; the article identifies APT29 as also known as Midnight Blizzard and Cozy Bear. The U.K. and partner governments attribute the broader APT29 group to Russia’s Foreign Intelligence Service.Midnight BlizzardMicrosoft assesses Storm-2945, which it attributes to CaptiveCrunch, to be an operational sub-cluster of Midnight Blizzard; the article identifies Midnight Blizzard as also known as APT29 and Cozy Bear.Storm-2945Microsoft attributes the CaptiveCrunch operation to Storm-2945 and assesses it to be an operational sub-cluster of Midnight Blizzard.
Malware
ChocoShellThe activity, tracked as CaptiveCrunch and attributed by Microsoft to Storm-2945, also used device code phishing and ChocoShell token theft to gain access to Microsoft 365 and Azure AD accounts.CornFlakeMicrosoft says hijacked hotel Wi-Fi captive portals were used to push a fake browser or OS update that delivered CornFlake, a RAT capable of stealing webcam images, microphone audio, keystrokes, cookies, and passwords.
Vendors
Products
Azure ADThe activity, tracked as CaptiveCrunch and attributed by Microsoft to Storm-2945, also used device code phishing and ChocoShell token theft to gain access to Microsoft 365 and Azure AD accounts.Google Chromewith the active window title, steal browser cookies and saved passwords, including cookies protected by Chrome App-Bound Encryption, scan removable media, and open a remote shell.Microsoft 365 Apps for EnterpriseThe activity, tracked as CaptiveCrunch and attributed by Microsoft to Storm-2945, also used device code phishing and ChocoShell token theft to gain access to Microsoft 365 and Azure AD accounts.