Corporate travelers face a sophisticated new threat from compromised hotel, conference and guest Wi-Fi networks. Microsoft has attributed an ongoing campaign called CaptiveCrunch to Storm-2945, which it assesses to be an operational sub-cluster of the Russian state-linked Midnight Blizzard espionage group.
The attackers are manipulating DNS and HTTP traffic on networks that use captive portals. This position allows them to redirect travelers to actor-controlled infrastructure, impersonate Microsoft services and present convincing browser, driver or operating system update messages.
From Wi-Fi Connection to Full Device Access
Some victims are directed to ClickFix-style instructions that persuade them to run commands or install software manually. The campaign has delivered CornFlake, a Windows remote access trojan written in Go. It can establish multiple persistence mechanisms, capture keystrokes and clipboard contents, steal files and credentials, collect browser sessions, record audio and video, and give operators a remote command shell.
The malware can disguise itself behind fake Windows Update, Defender scan, DirectX installation or browser update windows. While the victim watches a familiar progress display, the implant copies itself into the user profile and registers services, scheduled tasks and startup entries.
CaptiveCrunch also incorporates device-code phishing. Victims may be asked to enter a code into a legitimate Microsoft sign-in page, unknowingly authorizing an attacker-controlled session. Microsoft has observed signs that similar landing pages may target Android devices through malicious APK downloads.
Why Business Travelers Are Valuable
Travelers often connect to unfamiliar networks while carrying devices with access to email, cloud platforms, source code and internal collaboration services. They may also accept unusual connection prompts because captive portals already require extra steps. In my view, this combination of valuable access and lowered suspicion makes hospitality networks an ideal intelligence-collection point.
Defensive Priorities
- Prefer mobile hotspots, eSIM connections or other private connectivity over guest Wi-Fi.
- Never install updates or certificates offered by a captive portal.
- Use operating system update tools rather than browser prompts.
- Deploy phishing-resistant authentication and risk-based conditional access.
- Block OAuth device-code authentication unless a documented business requirement exists.
- Train employees to reject instructions that request pasted PowerShell or command-line content.
Organizations should also investigate downloads that occur immediately after a device completes a Wi-Fi connectivity check. CaptiveCrunch shows that encrypted websites and multifactor authentication do not eliminate network-based risk when attackers combine traffic manipulation, social engineering, token theft and endpoint malware. Secure travel now requires coordinated controls across connectivity, identity and endpoint detection rather than reliance on a VPN alone.
([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/))