CaptiveCrunch: Russia’s Midnight Blizzard Is Hijacking Hotel Wi-Fi to Steal Your Microsoft 365 Credentials

Every time a business traveller checks into a hotel and taps “Accept” on the captive portal, they hand the network a degree of implicit trust. Russia’s most elite intelligence-linked hacking group just weaponised that moment. In a campaign Microsoft calls CaptiveCrunch, the SVR-linked threat actor Midnight Blizzard — also tracked as APT29 and NOBELIUM — has been systematically compromising hospitality Wi-Fi networks worldwide since at least February 2026, using them as a silent launch pad to steal Microsoft 365 credentials, Azure AD tokens, and browser-saved passwords from corporate travellers. Disclosed on July 31, 2026 in a detailed Microsoft Security Blog post, and with exploitation confirmed active through early August, this is not a theoretical risk: it is happening right now, in hotels your executives are almost certainly staying in.

What Is CaptiveCrunch and Who Is Behind It?

Microsoft attributes the campaign to Storm-2945, a sub-cluster of Midnight Blizzard — the Russian Foreign Intelligence Service (SVR) actor responsible for the 2020 SolarWinds supply chain attack and 2021 Microsoft email breach. CaptiveCrunch is the codename for the specific operation targeting public Wi-Fi captive portals globally, including hotels, conference centres, and shared venues.

The operation began with OAuth device-code phishing and adversary-in-the-middle (AiTM) lures as early as February 2026, then escalated in May 2026 with active DNS and HTTP traffic manipulation on compromised captive portal equipment. Microsoft’s Threat Intelligence team published their findings on July 31, 2026 after months of investigation — and confirmed active exploitation was still ongoing as of early August 2026.

This is not opportunistic cybercrime. Midnight Blizzard is state-sponsored intelligence collection. Their historical targeting includes government ministries, diplomatic missions, defence contractors, technology companies, and think tanks. If your organisation’s executives travel internationally and use Microsoft 365, you are in this group’s scope.

Technical Breakdown: How the Attack Unfolds

The attack chain is elegant and multi-layered. Here is what happens from the moment your device connects to a compromised hotel network:

Phase 1 — Network Interception

Midnight Blizzard compromises the captive portal infrastructure — typically an underpowered network appliance running firmware that has not been updated in years. They manipulate DNS resolution and HTTP traffic to intercept connectivity checks and redirect browsers to actor-controlled infrastructure. The victim sees what appears to be the hotel’s standard Wi-Fi sign-in page.

Phase 2 — Credential and Token Theft

Depending on the victim’s browser state and operating system, victims are funnelled through one of three attack paths:

Attack Method	Mechanism	What Is Stolen
AiTM Phishing	Proxy via domains like ms365-device[.]com, m365-owa[.]com	Session cookies, access tokens (bypasses MFA)
Device Code Phishing	Legitimate Microsoft sign-in with attacker’s device code	Valid OAuth tokens, persistent refresh tokens
ClickFix Malware Drop	Fake Windows/Defender/browser update prompts	Full system compromise via CornFlake + ChocoShell

Phase 3 — Malware Deployment

Where the victim falls for a ClickFix lure, two malware families are deployed:

• CornFlake is a full-featured Golang remote access trojan. It hides behind fake Windows Update or Defender scan progress windows while installing itself as a Windows service (svchost32 displayed as “Cloud Sync Service”), then activates keylogging, clipboard monitoring, screenshot capture, microphone and webcam recording, file exfiltration (up to 1,000 files or 500 MB per cycle, categorised by type), and a ChromeKatz module that bypasses Chrome’s App-Bound Encryption to harvest saved credentials.
• ChocoShell is an in-memory PowerShell infostealer focused on identity material. It silently lifts Microsoft 365 access tokens, Azure AD refresh tokens, and Web Account Manager (WAM) .tbres files using three UAC bypass techniques. It also copies Firefox’s cookies.sqlite database, exploits Chrome DevTools Protocol for plaintext cookie extraction, and harvests all saved Wi-Fi credentials — meaning the attacker can pivot to your corporate office network if the same device later connects there.

A third component, FruitStone, is the operator’s web-based command-and-control panel — a polished “CloudSync Console” interface that provides a real-time dashboard of infected victims, interactive remote shell, file browser, screenshot viewer, and a campaign-builder wizard for crafting custom CornFlake payloads.

Microsoft has published specific indicators of compromise: key C2 IPs include 213.145.86[.]112 and 107.189.26[.]194; CornFlake SHA-256: 918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593; ChocoShell SHA-256: be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c.

Why India Needs to Pay Attention Right Now

India’s business travel volumes have returned to pre-pandemic levels, and Indian enterprises are among the world’s fastest-growing Microsoft 365 adopters. International conferences, G20 side meetings, diplomatic engagements, and BFSI roadshows bring precisely the kind of high-value targets that Midnight Blizzard prioritises. Hotel networks across metro cities and tier-2 hubs are rarely audited for captive portal security — the network equipment is often third-party managed with factory credentials.

Furthermore, India’s strategic importance means SVR-linked actors have clear motivation. Government ministry officials, defence sector contractors, and technology company C-suite executives travelling to and from India should treat every public Wi-Fi as adversarially controlled infrastructure. That is not paranoia — it is the operationally correct assumption given this campaign.

What You Should Do: Sanjay Seth’s Zero-Trust Defensive Playbook

The fundamental principle here is one I have advocated for years in my work with enterprises across the NCR: network location is not a trust signal. Whether your device is on the office LAN or a five-star hotel network, the posture should be identical. Here is the priority-ordered response for IT and security leaders:

1. Disable Microsoft Entra Device Code Authentication unless your organisation has a specific operational requirement for it. In Entra ID Conditional Access, block the Device Code Flow and restrict it to trusted named locations. This cuts off one of CaptiveCrunch’s primary credential-theft vectors.
2. Deploy phishing-resistant MFA: FIDO2 passkeys or hardware security keys (FIDO2-compliant). Standard TOTP or SMS MFA is bypassed by AiTM attacks. Passkeys are not.
3. Enforce Zero Trust Network Access (ZTNA) for all travel scenarios: Every corporate device connecting from any network outside the office perimeter should tunnel through your ZTNA gateway before accessing M365, Azure, or any internal resource. FortiClient with FortiGate ZTNA provides exactly this capability — the hotel network becomes irrelevant because the device is never “on” the corporate network until identity and device health are verified regardless of network.
4. Block hotel and public Wi-Fi on company devices by MDM policy: Require a managed, VPN-on-always profile. Encourage executives to use a corporate mobile hotspot or 4G/5G cellular data for sensitive work — treat unmanaged Wi-Fi as untrusted pipe.
5. Push Microsoft Entra Continuous Access Evaluation (CAE): This feature revokes tokens in near-real-time when anomalous sign-in risk is detected, shrinking the window attackers have to abuse stolen session material.
6. Hunt your environment for the published IOCs using Microsoft Defender XDR advanced hunting queries (available in Microsoft’s CaptiveCrunch advisory). Block the known C2 IPs at your FortiGate perimeter via threat intelligence feeds.
7. User education: Train road-warriors never to install software, updates, or browser extensions from a captive portal page. Any prompt invoking PowerShell, CMD, or a file download on a hotel sign-in screen is a social engineering attack — full stop.

For organisations I consult with, I also recommend running a tabletop exercise specifically simulating a compromised hotel network scenario to test IR detection and response time. The combination of identity theft and persistent RAT installation means the initial dwell can be very short before damage is done.

Frequently Asked Questions

Does using a regular VPN protect against CaptiveCrunch?

A VPN encrypts your traffic after the connection is established — but the CaptiveCrunch attack intercepts traffic during the captive portal phase, before your VPN tunnel is up. ClickFix malware drops can occur at this pre-tunnel moment. Additionally, some consumer VPNs are themselves targets. The correct control is an always-on corporate ZTNA or VPN with split-tunneling disabled, combined with device health attestation, so no corporate traffic flows until the tunnel is established and verified.

We use MFA everywhere — are we safe?

If you are using SMS OTP, authenticator app TOTP, or push notifications, no — AiTM attacks transparently relay the MFA prompt to the real Microsoft sign-in page and capture the resulting session token. The only MFA that is resistant to AiTM is FIDO2 passkeys or hardware security keys, because the cryptographic response is bound to the legitimate domain and cannot be relayed to a phishing domain.

How do I know if a device is already infected with CornFlake or ChocoShell?

Look for a Windows service named svchost32 with display name “Cloud Sync Service”, unexpected scheduled tasks, and outbound HTTPS to the published C2 IPs. Microsoft Defender for Endpoint (with the latest intelligence) detects both malware families. Run the advanced hunting queries published in Microsoft’s CaptiveCrunch advisory across your fleet. Immediately revoke all active M365 sessions and rotate credentials for any user who was travelling during the May–August 2026 window.

Should we block hotel Wi-Fi networks entirely for company devices?

Yes, where operationally feasible — enforce this via MDM policy. Where it is not feasible (some locations have poor cellular coverage), a strict always-on ZTNA profile that activates before any corporate application can connect is the mandatory alternative. The hotel network should be treated as an untrusted ISP, nothing more.

The Bigger Picture: Nation-State Actors and the Hospitality Blind Spot

CaptiveCrunch is not the first time Midnight Blizzard has targeted hospitality networks. Their predecessor campaign from 2017, dubbed DarkHotel (a separate but thematically similar operation), used hotel Wi-Fi to target executives. Almost a decade later, the attack surface has expanded — captive portals are now ubiquitous, corporate devices carry more sensitive tokens than ever, and Microsoft 365’s unified identity architecture means a single stolen refresh token can unlock email, Teams, SharePoint, OneDrive, and Azure simultaneously.

The lesson is clear: perimeter-based security models fail the moment your users leave the perimeter. Zero trust — verify every user, every device, every access request regardless of network — is the architectural answer. For Indian enterprises planning to double down on Microsoft 365 workloads or send executives to high-stakes meetings abroad, now is the time to close this gap.