GoKawiilMicrosoft has linked a global campaign targeting hospitality Wi-Fi networks to the Russian threat actor Midnight Blizzard, also known as APT29.
The activity was previously disclosed in a report from cybersecurity company ReliaQuest, which detailed how the attacker changed DNS settings on Wi-Fi devices to steal Microsoft 365 accounts.
Besides attributing the campaign to Russian hackers tracked as Storm-2945 - a sub-cluster of Midnight Blizzard, Microsoft identified two malware families called CornFlake and ChocoShell with capabilities for persistent access, credential theft, surveillance, and data exfiltration.
Microsoft named the campaign CaptiveCrunch and believes it has been active since at least early May, although the threat actor has been running device and OAuth code phishing operations since February.
Attack chain
The attackers manipulate DNS and HTTP traffic on networks served by captive portal equipment, allowing them to intercept user connections to hotel and conference center Wi-Fi networks.
Like ReliaQuest, Microsoft was unable to determine the exact initial compromise, although it noted signs of breaches in shared infrastructure rather than isolated devices.
After modifying DNS settings, the attacker can redirect victims to phishing pages that impersonate Microsoft 365 login portals, or to device code phishing pages that abuse Microsoft Entra ID authentication flows. Microsoft observed this activity since July.
A third option not previously disclosed involves using fake browser and operating system update pages that deliver malware to Windows via ClickFix prompts for user verification.
ClickFix prompt in CaptiveCrunch campaign
... continue reading