Microsoft has tracked traffic manipulation across hospitality networks in several countries since early May, in an operation researchers call CaptiveCrunch. Guests connecting to hotel Wi-Fi get pushed a fake browser or operating system update, and the payload is CornFlake, a Go-based remote access trojan that captures webcam images, microphone audio, and keystrokes. (Source: The Hacker News)

The mechanism is straightforward. With administrative control of that gateway, attackers forged DNS answers and redirected a laptop's automatic connectivity check to a page of their choosing.

That page is not an exploit. Some versions use ClickFix instructions telling the victim to open a terminal or another Windows utility and paste an attacker-supplied command. The gateway decides where your employee lands; your employee still has to run the payload, which is why traveling staff are the actual control point here.

Alongside CornFlake, researchers identified ChocoShell, an in-memory PowerShell stealer that collects Microsoft 365 and Azure Active Directory access and refresh tokens plus Web Account Manager tokens. Stolen tokens allow session replay without a browser cookie, meaning an attacker reaches your tenant with an already-authenticated session rather than a password.

Attribution sits with Microsoft, which tracks the activity as Storm-2945 and assesses it to be an operational sub-cluster of Midnight Blizzard — also called APT29 and Cozy Bear, and attributed by the U.S. and U.K. governments to Russia's Foreign Intelligence Service. ReliaQuest documented the same Microsoft-impersonating domains eight days earlier and noted tradecraft resembling APT28 (Fancy Bear, Forest Blizzard), but declined to attribute because the overlap is behavioral rather than technical.

Hotel networks suit this pattern: users are transient, the venue's IT is outside your monitoring, and staff treat the portal prompt as routine. Any executive or consultant working from a hotel room falls inside the target set.

Attack Chain: From Wi-Fi Compromise to Malware Execution

The initial access to the gateway itself is the least-documented link in the chain. ReliaQuest assesses with low-to-medium confidence that exposed management interfaces combined with weak or reused administrator credentials gave attackers control, but said visibility constraints prevented confirmation. Microsoft separately found common equipment and management systems across the affected networks, which it says could reflect access to shared services within portions of the captive portal ecosystem — meaning a single upstream compromise may explain multiple venues rather than dozens of independent break-ins.

Once positioned, the operators do not push code silently. The forged answers redirect a laptop's automatic connectivity check — the background request Windows and macOS make to confirm internet access — to attacker infrastructure that renders a fake browser or OS update page. That maps to T1557 (adversary-in-the-middle) and T1584.002 (compromised DNS server infrastructure), and it means the prompt arrives in the exact moment a user expects the network to talk back.

Some landing pages instead serve ClickFix instructions that tell the victim to open a terminal or another Windows utility and paste an attacker-supplied command — T1204.004, malicious copy and paste. Execution therefore requires a human action every time, which is why the redirect volume tells you nothing about the compromise count. The reports document active redirection and delivery but do not quantify successful executions, device-code approvals, or stolen accounts.

Since July 16, a second branch appeared: some landing pages redirect guests into Microsoft's device code authentication flow. Entering the attacker-supplied code on Microsoft's genuine sign-in page grants the attacker-controlled session MFA-satisfied access — no malware on the endpoint, no credential capture, and an authentication event that looks legitimate in your sign-in logs.

On the malware branch, execution proceeds behind a fake progress window that holds the victim's attention. Host-side artifacts worth hunting:

• Self-copy to %APPDATA%\svchost32\svchost32.exe
• A registered service named svchost32 with the display name Cloud Sync Service (T1543.003)
• A Registry Run key and a scheduled task used together (T1547.001, T1053.005)
• A watchdog component that restores any persistence mechanism removed by defenders

That watchdog matters for incident response scoping. Deleting the Run key or the task without killing the service returns the host to a compromised state, so partial remediation reads as a clean result while access continues.

Post-install collection includes idle-triggered screenshots (T1113), clipboard contents paired with the active window title (T1115), browser cookies and saved passwords — including cookies protected by Chrome App-Bound Encryption — removable media scanning, and an interactive remote shell.

ChocoShell runs a different way. It is an in-memory PowerShell stealer that collects Microsoft 365 and Azure Active Directory access and refresh tokens plus Web Account Manager tokens from .tbres files in the Token Broker cache. Those tokens enable session replay without a browser cookie, so a stolen refresh token keeps producing valid access after the laptop is wiped.

Network-side, both ReliaQuest and Microsoft documented Microsoft-impersonating domains and overlapping infrastructure across the affected venues. Microsoft has not named a hotel, venue, or captive portal vendor, and no separate public technical report has independently corroborated the CaptiveCrunch-to-Storm-2945 link.

Business and Operational Impact for Hospitality and Traveling Professionals

Storm-2945 sits under Midnight Blizzard, the actor the U.S. and U.K. governments attribute to Russia's Foreign Intelligence Service. That attribution changes what the compromise costs you: the objective is durable access to your correspondence, contracts, and accounts, not a quick payout.

The clearest business exposure comes from token theft. ChocoShell, an in-memory PowerShell stealer, collects Microsoft 365 and Azure Active Directory access and refresh tokens along with Web Account Manager tokens pulled from .tbres files in the Token Broker cache. Those stolen tokens enable session replay without a browser cookie, so an attacker reaches your tenant from their own machine while your user's laptop sits closed in a hotel room.

If your MFA program is the control you rely on for remote access, note what happened after July 16. Landing pages began redirecting guests into Microsoft's device code authentication flow, and a victim who enters the attacker-supplied code on Microsoft's genuine sign-in page hands the attacker-controlled session MFA-satisfied access. The resulting sign-in is legitimate from the identity provider's perspective, which means your SOC is reviewing an authenticated session rather than a blocked one.

On the endpoint, CornFlake is built to stay. It copies itself to %APPDATA%\svchost32\svchost32.exe, registers the svchost32 service under the display name Cloud Sync Service, and backs that up with a Registry Run key and a scheduled task. A watchdog restores any persistence mechanism defenders remove, so a helpdesk technician who deletes one artifact has not cleaned the machine — you are looking at a rebuild and a credential reset for that user.

What it collects maps directly onto the work your travelers do. The implant takes idle-triggered screenshots, records clipboard contents together with the active window title, steals browser cookies and saved passwords including cookies protected by Chrome App-Bound Encryption, scans removable media, and opens a remote shell. Clipboard capture paired with window titles means a password copied out of a vault, a wire instruction, or a deal code name arrives at the operator with the context attached.

Think about which of your people connect from hotels. Executives at conferences, deal teams during diligence, outside counsel, and engineers travelling to customer sites all carry the documents that make espionage worthwhile, and the remote shell gives operators a path from that laptop into whatever your VPN and SSO grant it. For a professional services or manufacturing firm, the loss is unpublished designs, pricing, and client correspondence — material that produces no ransom note and no visible outage, which is why it can run for months.

For hotel operators and venue managers, the liability question is about your guests' devices, not your PMS. Microsoft found common equipment and management systems across the affected networks, so a property that never suffered its own intrusion can still be the place a corporate customer's laptop was compromised. Corporate travel accounts ask about guest network security after incidents like this, and where guest identity data is handled through the same portal infrastructure, data protection regulators expect notification when that data is exposed.

One caveat worth carrying into your risk assessment: the published reports document active redirection and malware delivery but do not quantify reach or conversion. There are no counts of successful executions, device-code approvals, or stolen accounts, so the public record does not establish how often a redirect became a compromise.

Detection and Immediate Response for Hotels and Enterprise Networks

Immediate (0–24 hours)

Block Microsoft's device code authentication flow in Conditional Access for every user group that does not need it. That single change removes the path where a guest enters an attacker-supplied code on a legitimate sign-in page and hands over an MFA-satisfied session.

Next, hunt for the implant on any device that connected to hotel or venue Wi-Fi since early May. Search your endpoint fleet for these artifacts:

• The file %APPDATA%\svchost32\svchost32.exe on any user profile.
• A Windows service named svchost32 with the display name Cloud Sync Service.
• A Registry Run key entry and a scheduled task pointing at that same executable — the implant uses both, plus a watchdog process that recreates whichever one you delete.

That watchdog matters for your response plan. If your technician removes the Run key and calls the machine clean, persistence returns. Treat the host as compromised and pull it off the network rather than cleaning in place.

Tell travelling staff, in writing today, to decline any software update, certificate, browser update, troubleshooting tool, or security utility offered through a captive portal, and to install updates only on your corporate network or a personal hotspot.

Short term (1–7 days)

Review sign-in logs for device code grants and for token use that does not match the user's device or location. ChocoShell pulls access, refresh, and Web Account Manager tokens, so a stolen session appears as a legitimate authenticated user with no failed password attempts to alert on. In environments Capstone manages, Adlumin correlates those authentication anomalies — device code approvals, impossible-travel token replay, sessions with no matching MFA challenge — against normal user baselines.

Revoke refresh tokens for any user who travelled during the affected window rather than just resetting passwords. A password change alone does not invalidate a replayed session.

On the endpoint side, check for the behaviours the implant produces before you find its files: idle-triggered screenshot activity, clipboard collection paired with active window titles, browser credential store access including Chrome App-Bound Encryption protected cookies, and enumeration of removable media. Any of these on a laptop that recently used guest Wi-Fi warrants forensic imaging before reimaging.

For hotel and venue operators, audit administrative access to the captive portal gateway and every management interface reachable from outside the guest VLAN. Compare current DHCP and DNS settings issued to guest devices against your documented baseline, and pull authentication logs for the gateway going back to at least May.

Longer term

Deploy an always-on, full-tunnel VPN on every corporate laptop and phone, configured so DNS queries resolve through your own resolvers before the venue gateway can answer them. This is the control that neutralises the redirection technique entirely, and it needs to be enforced by policy rather than left to the user to enable.

Separate guest Wi-Fi from every management, point-of-sale, and property system at the network level, and put the portal gateway's admin interface behind an authenticated jump path with unique credentials per venue. Shared or reused administrator credentials across properties are what let one compromise reach many.

Finally, restrict which applications your users can execute from %APPDATA% and require service installation through your management platform. The attack depends on a person running an attacker-supplied command, so application control closes the last step even when the redirect succeeds.

Hardening Hotel Networks and Corporate Traveler Protections

Start with the connection policy on your endpoints: require an always-on, full-tunnel VPN that fails closed, so a laptop that cannot reach the corporate concentrator gets no general internet access at all. That configuration sends DNS queries to your resolvers instead of the venue gateway, which removes the attacker's ability to answer a connectivity check with a forged record. Split-tunnel profiles reopen the exact gap this operation uses, so treat any exception as a documented risk acceptance rather than a default.

Identify

Build a list of the assets that actually matter here. For a hotel or venue operator, that means every wireless controller, captive portal appliance, DNS forwarder, and any management platform run by a third-party integrator — Microsoft found common equipment and management systems across affected networks, so shared upstream services belong in your inventory even when someone else administers them.

On the enterprise side, identify which employees travel and what those devices can reach. A sales laptop with standing access to your file shares and email tenant carries different risk than a kiosk device, and your controls should reflect that difference.

Protect

For venue networks, the controls that break this attack chain are unglamorous and specific:

• Put guest wireless, the captive portal, and controller management on separate VLANs with no routing between them, so a guest-facing service cannot reach the administrative plane.
• Remove controller and portal management interfaces from public internet exposure entirely; restrict them to a jump host or management VPN.
• Replace shared or vendor-default administrator credentials with unique accounts and enforce MFA on every management login.
• Verify firmware against vendor-published hashes before installing, and restrict who can push configuration to access points.

For corporate endpoints, application control does the heavy lifting. Block execution of unsigned binaries from user-writable directories and require valid code signatures for anything that installs itself, which stops a downloaded "update" from running even when a user is fully convinced it is legitimate. SentinelOne enforces execution policy and blocks the unsigned payload and its persistence attempts across managed environments, including the watchdog process that reinstates removal-resistant persistence.

Train travelers on one narrow rule rather than a general awareness module: no software update, certificate, browser plugin, troubleshooting tool, or security utility offered through a captive portal is ever legitimate. Updates come from the vendor's own channel or your patch management system, verified after the VPN is up. Give staff corporate hotspots or cellular tethering so the safe option is also the convenient one.

Detect

Alert on DNS answers that resolve Microsoft-branded hostnames to non-Microsoft address space from a client that just joined an untrusted network. On the venue side, enable logging on the wireless controller and forward it off the appliance — an attacker with administrative control of the gateway can edit local logs, so remote copies are the only trustworthy record.

Recover

Plan to reimage, not clean. The implant restores persistence mechanisms that defenders remove, so a suspected infection on a traveling laptop should be a rebuild from a known-good image with credentials rotated afterward, not a quarantine-and-return.

Keep a small pool of loaner devices with minimal standing access for staff attending conferences or long hotel stays. That limits what a redirect can reach and lets you retire a suspect machine without pulling someone off work for a week.

Key Takeaway: Verify Update Sources, Segment Networks, Monitor Access Points

Two research teams examined the same infrastructure and landed in different places on who runs it. ReliaQuest documented the Microsoft-impersonating domains and overlapping infrastructure eight days before Microsoft published, and noted tradecraft resembling APT28 — the GRU unit also called Fancy Bear and Forest Blizzard — but stopped short of attribution because the assessment rested on TTP overlap rather than direct technical linkage. Microsoft's link from this operation to Storm-2945 remains Microsoft's own assessment; no separate public technical report has independently corroborated it.

For your risk decisions, the disagreement changes little. Both readings point to a Russian state intelligence service, and Microsoft itself notes the resemblance to the Forest Blizzard router hijacking it disclosed in April. The objective in both cases is collection against people worth watching, which is what makes travelling executives, counsel, and engineers the population that matters here.

The second thing to carry away is what the public record does not contain. Neither report quantifies reach or conversion — there are no counts of successful executions, device-code approvals, or stolen accounts.

Without those numbers, you cannot size your own exposure from the reporting. The absence of a published victim count is not evidence that your people were not redirected.

Third, this attack needs the victim to act. The forged answer only puts a page in front of you; someone still downloads the fake update or pastes a supplied command into a Windows utility. A captive portal offering you software, a certificate, or a troubleshooting tool is the attack, not a service.

If you operate a hotel network, or your staff travel regularly, treat venue Wi-Fi as compromised until you have evidence otherwise.