What Microsoft Reported
Microsoft Threat Intelligence says Storm-2945, which it assesses as a sub-cluster of the Russian actor Midnight Blizzard, has manipulated DNS and HTTP traffic on hospitality-sector networks served by captive portals since early May 2026. Microsoft calls the operation CaptiveCrunch. The US and UK governments attribute Midnight Blizzard to Russia’s SVR foreign intelligence service.
The initial way into the portal networks was still under investigation, but Microsoft saw common equipment and management systems across affected networks. That suggests access to shared services rather than one hotel at a time. ReliaQuest reported similar activity at conference centres and other shared venues on July 23.
How Travellers Are Hit
- Browser connectivity checks are answered with fake browser or operating-system updates and ClickFix prompts that ask the user to run a command. Some landing pages also include instructions for installing an Android APK.
- Look-alike Microsoft domains host adversary-in-the-middle phishing. Since July 16 some landing pages have pushed users into Microsoft Entra ID device code sign-in.
- CornFlake is a Go-based Windows RAT that installs as
%APPDATA%\svchost32\svchost32.exeand registers a “Cloud Sync Service”. It can log keystrokes, capture the screen, microphone and webcam, steal browser credentials and give the operator a remote shell. - ChocoShell is an in-memory PowerShell stealer that takes browser cookies, saved passwords, Microsoft 365 SSO tokens and Wi-Fi keys, and tries three UAC bypasses.
What To Do Before The Next Trip
- Prefer a mobile hotspot or company travel router over hotel or conference Wi-Fi, and never install updates offered by a captive portal.
- Block device code flow where it is not needed and require phishing-resistant MFA through Conditional Access.
- Hunt for the
svchost32service and for files created within two minutes of a Wi-Fi connectivity check. Microsoft published queries for both. - Do not reuse corporate credentials on guest-network registration pages.
Source Context
This item was rebuilt from the following primary sources and original reporting:
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
- Microsoft Security Blog: CaptiveCrunch: Midnight Blizzard targets travelers worldwide
- ReliaQuest: DNS poisoning tactics expand to hospitality
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Monday’s brief: GlobalProtect logins without passwords, then SonicWall, AhsayCBS and NetScaler
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
