Since July 16, some CaptiveCrunch landing pages have redirected guests into Microsoft's device code authentication flow, a gating step that — if a visitor enters an attacker-supplied code on Microsoft's legitimate sign‑in page — can yield an attacker-controlled session that appears to have satisfied multi‑factor authentication, Microsoft says.
How the captive-portal DNS hijack works
Microsoft and ReliaQuest describe a simple but effective chain: attackers gained administrative control of a venue's captive‑portal gateway, which also served as the DNS resolver assigned to connected devices. From that position the gateway's operators forged Domain Name System answers and redirected outbound traffic. That redirection let them route a laptop's automatic connectivity check or a user's browser request to fake updates — including bogus browser or operating‑system installers — presented as legitimate software.
The gateway determines where a device is sent, but it does not silently install malware on the endpoint. Some landing pages use ClickFix-style instructions that tell victims to open a terminal or a Windows utility and run an attacker-supplied command. The victim still has to download or execute the payload for the compromise to proceed.
Microsoft has observed this traffic manipulation since early May on hospitality networks in several countries, but it has not named any affected hotel, venue, or captive‑portal vendor. ReliaQuest documented overlapping Microsoft‑impersonating domains and infrastructure eight days before Microsoft published its findings, and it noted common equipment and management systems across the affected networks — a pattern that Microsoft says could reflect access to shared services within portions of the captive‑portal ecosystem. If so, the compromises may not have been isolated to single venues.
CornFlake: remote‑access capabilities and persistence
Microsoft attributes the malware delivered via these fake updates to CornFlake, a Go‑based remote access trojan. CornFlake copies itself to %APPDATA%\\svchost32\\svchost32.exe and registers a service under the display name "Cloud Sync Service." A fake progress window is used to hold the victim's attention while the implant establishes itself.
Once active, Microsoft says CornFlake can capture webcam images, microphone audio, and keystrokes; take idle‑triggered screenshots; record clipboard contents alongside the active window title; steal browser cookies and saved passwords (including cookies protected by Chrome App‑Bound Encryption); scan removable media; and open a remote shell. For persistence it uses a Registry Run key and a scheduled task, and a watchdog component restores any persistence mechanism defenders remove.
ChocoShell: in‑memory PowerShell stealer and token capture
Microsoft also identified ChocoShell, an in‑memory PowerShell stealer that targets authentication tokens rather than cookies alone. ChocoShell collects Microsoft 365 and Azure Active Directory access and refresh tokens, along with Web Account Manager (WAM) tokens, by harvesting .tbres files in the Token Broker cache. The report highlights that these stolen tokens can enable session replay without needing a browser cookie.
Attribution: Storm‑2945 and overlapping assessments
Microsoft tracks this operation as CaptiveCrunch and attributes it to Storm‑2945, which it assesses to be an operational sub‑cluster of Midnight Blizzard — also named APT29 and Cozy Bear. The U.S. and U.K. governments, and the U.K. National Cyber Security Centre with its partners, attribute the broader APT29 grouping to Russia's Foreign Intelligence Service (SVR). Microsoft acknowledges the resemblance to the router‑hijacking tradecraft disclosed in April that it called Forest Blizzard, while maintaining the specific CaptiveCrunch→Storm‑2945 link as its assessment.
ReliaQuest, which published its findings earlier, noted that some tradecraft resembled APT28 (also known as GRU/Fancy Bear) but stopped short of making that attribution because the similarity rested on tactic, technique, and procedure overlap rather than a direct technical linkage.
What this means for travelers, corporate security teams, and government cyber centers
- Travelers: Researchers advise using private connections and rejecting software updates, certificates, browser updates, troubleshooting tools, or security utilities offered through captive portals. Because the gateway can only redirect — not silently install — users must avoid downloading or executing files presented via a captive portal.
- Corporate security teams: ReliaQuest recommends an always‑on, full‑tunnel VPN that sends DNS queries through corporate resolvers before a venue gateway can answer them. Microsoft recommends blocking the device‑code authentication flow through Conditional Access wherever it is not needed to prevent attacker‑supplied codes from granting session access.
- Government cyber centers: The overlapping infrastructure and recurring tradecraft seen across multiple venues raise questions about shared services within the captive‑portal ecosystem; both Microsoft and ReliaQuest highlight the need to investigate exposed management interfaces and weak or reused administrator credentials, which ReliaQuest assesses with low‑to‑medium confidence may have enabled initial access.
The public record documents active redirection and the delivery of surveillance malware, but it does not quantify how often a redirect produced a successful execution, device‑code approval, or stolen account. Microsoft and ReliaQuest agree on the operational mechanics; they diverge on attribution nuance and on the degree to which shared infrastructure widened the impact. For travelers and defenders the immediate answer is practical and narrow: avoid captive‑portal offers to install software, prefer private or corporate VPNs, and limit the use of device‑code flows where they are unnecessary.
