When the Hotel Wi-Fi Login Page Bites Back
You’ve just landed, you’re exhausted, and the hotel lobby Wi-Fi asks you to tick a box and hit “connect.” That innocent little page could be the last thing your laptop ever does without your permission.
Microsoft Threat Intelligence has uncovered a campaign it calls CaptiveCrunch, active since early May, that hijacks captive portals on hotel and conference Wi-Fi networks. The goal? Route guests through attacker infrastructure and serve fake browser or OS updates that install Russian espionage malware.
The group behind it is Storm-2945, a sub-cluster of Microsoft ’s old friend Midnight Blizzard — also known as APT29, the Dukes, or Cozy Bear. Both the US and UK governments have pinned that crew on Russia’s Foreign Intelligence Service, the SVR.
How the Captive Portal Attack Works
This is not your typical phishing lure. The attackers don’t wait for you to click a link in an email. Instead, they intercept the automated connectivity checks that browsers and operating systems fire off the moment you join a new network.
Those checks normally hit a known endpoint and get a “200 OK.” Here, they get a page that looks like a legitimate update prompt. The landing pages use ClickFix techniques — fake verification failures that instruct you to paste a command into your terminal or Run dialog. Some even serve an APK, suggesting Android devices are in the crosshairs too.
From July 16 onward, some pages started redirecting users into device code authentication flows. You’re told to enter an attacker-supplied code on a real Microsoft sign-in page. The code is genuine. The session behind it is not.
Microsoft notes the device code trick isn’t new, but wrapping it in a captive portal makes it feel legitimate. When you’re already in a weird network environment, one more code prompt hardly registers.
Who’s Being Targeted?
Security firm ReliaQuest spotted part of this activity on July 23 and traced it to hotels, conference centers, and other shared venues. The victims are corporate travelers — people whose accounts are worth more than their luggage.
Three Malware Tools, One Cover Story
Once you’re hooked, the attackers drop a trio of tools, each with a specific job.
- CornFlake — a Go-based remote access trojan (RAT) that shows a fake progress window while it installs, then registers as a Windows service named “Cloud Sync Service.” It comes with keylogging, screenshots, microphone and webcam access, browser credential theft, a remote shell, and a watchdog that restores any persistence mechanism defenders remove.
- ChocoShell — a PowerShell infostealer that runs entirely in memory. It disables the Antimalware Scan Interface (AMSI) before harvesting browser cookies, saved passwords, Microsoft 365 single sign-on tokens, and Wi-Fi credentials.
- FruitStone — the command-and-control panel, dressed up as a fake enterprise cloud product to match the implant’s cover story.
ChocoShell’s developer comments are a tell. They name specific Microsoft detection signatures and explain each evasion choice. Microsoft says that level of annotation suggests AI-assisted code generation — and the company thanked Anthropic and OpenAI for their support during the investigation.
What This Means for Travelers
The takeaway is blunt: treat hotel, conference, and airport Wi-Fi as hostile territory. Use cellular or eSIM connectivity whenever possible. And never — ever — install software offered through a captive portal.
For enterprises, Microsoft recommends blocking device code flow where it’s not strictly needed and pushing passkeys over passwords. That’s sound advice, but it doesn’t stop the human reflex to click “update now” when the Wi-Fi gods demand it.
The bigger question is how the portals got compromised in the first place. Microsoft is still investigating but notes commonalities in equipment and management systems across affected networks. That hints at a shared service within the captive portal ecosystem being breached, rather than each hotel being individually hacked. One bad vendor, many poisoned lobbies.
If you’re heading to a conference this fall, pack an eSIM and a healthy dose of skepticism. Your hotel’s free Wi-Fi just got a lot less free.
