Travelers rely on hotel Wi‑Fi for work, messages, and everyday online tasks. But new reporting shows that hijacked hotel wi-fi can be used to manipulate what a captive portal shows you—and, in some cases, to deliver malware disguised as legitimate updates. The core idea is simple: if attackers control the gateway that you’re forced to visit when you join Wi‑Fi, they can steer your next clicks.
Microsoft describes an operation that delivered a remote access trojan (RAT) via fake browser update flows served over compromised hospitality networks. Researchers track the activity under names including CaptiveCrunch and an associated payload referred to as CornFlake. Security teams say the targeting has been observed across multiple countries since early May, though public reporting does not disclose specific hotels or vendors.
How hijacked hotel wi-fi turns a captive portal into an attack channel
On affected networks, the captive portal gateway didn’t only present a landing page. According to Microsoft and related research, the gateway also acted as the DNS resolver assigned to devices that connected to the network. When attackers can influence DNS responses, they can redirect the traffic that would normally reach real services.
This matters because captive portals are designed to intercept initial web requests and guide users through “log in” or “accept terms” pages. With control of the gateway, attackers can redirect what happens next—such as altering an automatic connectivity check so the browser lands on attacker-controlled update pages instead of genuine resources.
Fake updates and instructions that push you to run a payload
Microsoft’s analysis indicates the deception doesn’t always rely on silent infection. Some pages reportedly use step-by-step guidance—such as instructions telling victims to open a terminal or run a Windows utility with a command provided by the attackers. In those scenarios, the gateway controls where the user is redirected, but the device still needs the victim to download or execute the payload.
That shift can increase the chance that an action requires human interaction, which can help attackers bypass certain automated defenses. Still, it doesn’t reduce the threat: once the payload runs, surveillance and credential theft capabilities can follow.
The malware payload: CornFlake and its surveillance functions
The RAT delivered through the campaign is referred to as CornFlake. Microsoft describes it as a Go-based implant capable of taking control after execution. The implant copies itself into the user’s application data directory and sets up persistence using a service name shown to users as something benign.
During installation, a fake progress window may distract the victim while the files and service changes occur. After that, Microsoft notes a range of collection behaviors, including:
- Idle-triggered screenshots
- Microphone audio capture
- Keylogging
- Clipboard collection tied to the active window title
- Theft of browser cookies and saved passwords, including cookies protected by Chrome’s App-Bound Encryption
- Scanning removable media
- Opening a remote shell for further operator control
Microsoft also observed that persistence mechanisms could be restored by a watchdog process if defenders attempt to remove them, which can complicate cleanup after detection.
Token theft via in-memory PowerShell: ChocoShell
Beyond the RAT, researchers identified another component described as ChocoShell. Microsoft reports this as an in-memory PowerShell stealer designed to collect authentication tokens rather than relying only on browser cookies.
Specifically, it can collect Microsoft 365 and Azure Active Directory access and refresh tokens, along with tokens from the Web Account Manager (WAM). Those tokens may enable session replay even in cases where browser cookies are protected.
Reports tie ChocoShell to token cache files, indicating attackers are aiming to extend access without always triggering the same browser-cookie weaknesses that many users expect.
Device code redirection: turning MFA into an attacker-controlled session
One particularly concerning development described in the reporting is the use of Microsoft’s device code authentication flow. Starting around mid-July, some CaptiveCrunch landing pages redirected guests into a Microsoft device code sign-in process.
In these cases, entering an attacker-supplied code on what appears to be a legitimate Microsoft sign-in page can grant the attacker-controlled session access. Microsoft characterizes this as enabling multi-factor authentication (MFA) to be satisfied from the attacker’s perspective.
Microsoft recommends blocking the device-code flow through Conditional Access wherever it is not required. This advice is aimed at preventing redirected logins from succeeding even when the user interacts with a legitimate authentication interface.
Why a full-tunnel VPN can help reduce the gateway advantage
Researchers from ReliaQuest recommend a defensive step that targets the underlying weakness: DNS manipulation at the captive portal gateway. Their guidance emphasizes using an always-on, full-tunnel VPN. When the VPN routes traffic through corporate resolvers, the hotel gateway has far less influence over which DNS answers are returned.
In effect, you’re reducing the chance that the captive portal can steer your browser to attacker-controlled update pages by controlling the DNS responses that your device relies on.
Safer habits when a captive portal appears
Security guidance for travelers focuses on limiting interaction with untrusted captive portal content. Researchers advise using private connections rather than accepting what a venue’s portal offers, particularly when prompted to update software through the portal.
Based on the reporting, caution should extend to avoiding:
- Browser update offers presented by the portal
- Operating system update prompts served through the captive page
- Troubleshooting tools and “security utility” downloads
- Unfamiliar certificates or certificate prompts
- Any “update” steps that require installing or running something provided by the captive portal
The consistent message is that the gateway can change the destinations you see, so your best defense is to avoid trusting those prompts in the first place.
Attribution and what it does—and doesn’t—prove
Microsoft associates the campaign with an operation tracked as CaptiveCrunch and attributes it to Storm-2945. Microsoft describes Storm-2945 as an operational sub-cluster of Midnight Blizzard, also known as APT29 and Cozy Bear. U.S. and U.K. governments attribute the broader actor to Russia’s Foreign Intelligence Service (SVR).
Researchers also note overlap with earlier router hijacking disclosures and describe infrastructure and tradecraft similarities to other clusters. However, Microsoft and the broader public record do not provide a detailed, independently verified confirmation of every link beyond Microsoft’s assessment. In other words: attribution is based on available evidence and technique overlap, not always on direct technical proof that can be independently reproduced.
Limits in public data: redirection doesn’t always equal compromise
While the reporting clearly documents active redirection and malware delivery, it doesn’t provide metrics such as how many users executed the payload, how many device-code approvals occurred, or how often stolen sessions were successfully used. Without those counts, it’s difficult to estimate the real-world conversion rate from “visiting a fake update page” to “compromise.”
Researchers therefore treat the situation as a serious risk, but one where the exact scale remains uncertain from public information alone.
Shared infrastructure suggests the problem may extend beyond one venue
Microsoft reports common equipment and management systems across the affected hospitality networks. That could indicate access to shared services within portions of a captive portal ecosystem, meaning compromises may not be limited to a single hotel or venue.
Because Microsoft did not name a specific hotel or captive portal provider, the practical takeaway is to assume that any hospitality captive portal you don’t fully trust could be part of the same larger pattern.
Conclusion: protect yourself when hotel Wi‑Fi is not truly “safe”
Hijacked hotel wi-fi can transform captive portals into delivery mechanisms for surveillance malware—using fake update pages, deceptive instructions, and even redirection into authentication flows. The threat is not hypothetical: Microsoft and researchers describe RAT capabilities such as screenshot capture, audio and keystroke collection, credential and token theft, and remote shell access.
If you connect to hotel Wi‑Fi, keep your guard up. Prefer private connections, consider an always-on full-tunnel VPN, and reject update prompts and security utilities offered through captive portals. Small choices—like avoiding portal-driven downloads—can sharply reduce your exposure when the gateway is in hostile hands.
Source: https://thehackernews.com/2026/08/hijacked-hotel-wi-fi-pushes-fake.html
