SVR weaponizes public Wi‑Fi to deploy malware and harvest credentials
Microsoft disclosed that Russian SVR operatives are compromising captive-portal public Wi‑Fi networks at hotels and conference venues to deliver malware (CornFlake) and in-memory tools (ChocoShell) through a CaptiveCrunch campaign, using adversary‑in‑the‑middle traffic manipulation, fake update prompts, and device‑code phishing to steal credentials and access cloud accounts. The guidance emphasizes avoiding public networks, using personal hotspots, and enabling passwordless authentication while organizations should disable device‑code flows where possible.