Russian Hackers Hijack Hotel Wi-Fi Captive Portals to Steal Microsoft 365 Tokens
What Happened — Microsoft’s threat‑intel team identified a campaign (named CaptiveCrunch) run by the Russian SVR‑linked group Storm‑2945 (a sub‑cluster of Midnight Blizzard/Cozy Bear). Since May 2026 the actors have been tampering with DNS and HTTP traffic on hotel and conference‑center captive‑portal networks, redirecting guests to download the CornFlake RAT, which harvests Microsoft 365 authentication tokens and a wide range of credential data.
Why It Matters for Compliance & Audit Readiness
- The incident is a textbook example of a credential‑theft vector that SOC 2 Access Control policies must anticipate and log (e.g., MFA enforcement, token revocation, and continuous monitoring of privileged‑access sessions).
- Continuous‑compliance programs need auditable evidence that remote‑access points (guest Wi‑Fi, VPN, etc.) are covered by documented risk‑assessment and mitigation controls, otherwise a breach can invalidate the “Logical Access” CC6.1–CC6.7 criteria.
- Demonstrating that you have a formal security‑awareness program for travelers and contractors helps satisfy the “Security Awareness Training” requirement (CC7.1) and provides a defensible audit trail.
Who Is Affected – Hospitality venues that operate captive‑portal Wi‑Fi, corporate travelers using Microsoft 365, and any organization whose staff rely on public Wi‑Fi for work‑related tasks.
Recommended Actions
- Review and tighten your Logical Access controls: enforce MFA for all Microsoft 365 accounts, enable conditional access policies that block sign‑ins from high‑risk networks, and implement token‑revocation alerts.
- Extend your Security Awareness Training to include safe‑use guidelines for public Wi‑Fi and the risks of captive portals.
- Require hospitality partners to provide evidence of secure captive‑portal configurations (e.g., DNSSEC, TLS‑encrypted redirects) as part of your third‑party risk program.
Technical Notes – The attackers manipulate DNS/HTTP on captive portals to inject the CornFlake RAT (a Go‑based Windows service masquerading as “svchost32”). CornFlake persists via services, Run keys, scheduled tasks, and a watchdog routine, and communicates over an encrypted ECDH‑P‑256 channel. Source: Security Affairs