Hotel Wi-Fi just became a nation-state attack vector — and it bypasses MFA entirely.
Microsoft Threat Intelligence disclosed CaptiveCrunch, run by Storm-2945, a sub-cluster of Midnight Blizzard (APT29 / Cozy Bear, Russia SVR). They compromise hotel Wi-Fi portals to hijack Microsoft 365 and Azure AD sessions — no phishing email needed.
Attack chain:
- DNS poisoning at the gateway during connectivity checks
- Fake OS/browser update prompts deliver payloads
- ClickFix-style social engineering
- Microsoft OAuth device-code flow abused to authorize sessions
- WPAD abuse to intercept traffic
Toolkit:
- CornFlake — Go RAT disguised as an update, persists as a sync service
- ChocoShell — in-memory PowerShell infostealer, disables AMSI, steals cookies via Chrome's debug port (9222)
- FruitStone — web-based C2 panel
Why it matters: stolen session tokens bypass MFA completely. If the attacker has a live token, MFA already happened — for them.
Detection leads:
- New sync/cloud named services after untrusted reconnects
- AMSI bypass in PowerShell logs (Event ID 4104), no file write
- Unexpected device-code auth after hotel Wi-Fi use
- Chrome debug port 9222 from unexpected parent processes
Confirmed across US, India, Saudi Arabia — finance, legal, healthcare, retail orgs affected.
Full write-up with IOCs, WPAD hardening commands, SOC hunting queries:
https://www.xpert4cyber.com/2026/08/midnight-blizzard-hotel-wifi-hack.html
Top comments (0)