All articles tagged with #captivecrunch
Microsoft ties a global hospitality Wi‑Fi campaign to the Russian group Midnight Blizzard (Storm-2945), detailing DNS tampering and two malware families, CornFlake and ChocoShell, used to steal Microsoft 365 tokens and credentials via phishing, device-code prompts, and fake update pages; researchers urge treating hotel Wi‑Fi as untrusted, using MFA/passkeys, and avoiding corporate credentials on guest networks.
Microsoft and ReliaQuest warn that attackers hijack hotel captive portals to serve fake updates, delivering CornFlake RAT (and ChocoShell) via a compromised DNS/gateway, capturing keystrokes, webcam/mic, cookies and tokens. The operation, CaptiveCrunch, is linked to Storm-2945 and attributed to Russia's SVR-linked APT29, though attribution rests on overlapping techniques rather than public corroboration. The initial compromise vector is under investigation; mitigations include using private VPNs, avoiding captive-portal updates, and blocking attacker-authenticated device-code MFA flows via Conditional Access.