Microsoft Threat Intelligence disclosed on July 31, 2026 that Storm-2945, an operational sub-cluster of the Russian SVR-linked actor it tracks as Midnight Blizzard (APT29, Cozy Bear, NOBELIUM, the Dukes, Yttrium), has been manipulating DNS and HTTP traffic on hotel, conference centre and shared-venue Wi-Fi networks worldwide since early May 2026. Microsoft calls the campaign CaptiveCrunch. The operation redirects travellers to credential phishing and to fake update pages that install two malware families, CornFlake and ChocoShell. Critically, Microsoft has not published a victim count: iTnews notes that Microsoft's technical analysis said compromises occurred in "several countries" without naming them, and gave no total for affected venues, organisations or individuals. Any figure circulating for this incident is not sourced to the primary report.
What Happened
The activity was first surfaced publicly by security firm ReliaQuest on July 23, 2026, which observed attackers modifying the DNS configuration of compromised SOHO routers and captive portal gateways to reroute users through infrastructure they controlled. ReliaQuest noted overlaps with FrostArmada, an espionage operation associated with APT28 (Forest Blizzard, Fancy Bear), but did not make a clear attribution.
Microsoft's report supersedes that ambiguity. It acknowledges TTP similarities to the Forest Blizzard DNS hijacking operation it disclosed in April 2026, but attributes CaptiveCrunch to Storm-2945 under Midnight Blizzard. That is a meaningful correction: ReliaQuest's initial read pointed toward Russian military intelligence, while Microsoft's assessment points to the SVR foreign intelligence service. Defenders reading only the July 23 research would have the wrong actor.
The timeline runs in two phases. Storm-2945 has been running AI-augmented device code and OAuth phishing against Microsoft 365 users since February 2026. In early May 2026 it escalated to compromising the network equipment itself. BleepingComputer reports Microsoft observed the device code phishing redirects specifically since July.
On geography, accounts are thin and differ in specificity. Microsoft says "several countries" and declines to name them. ReliaQuest, per iTnews, found compromised captive portal gateways across multiple United States cities as well as in India and Saudi Arabia.
What Was Taken
No source quantifies stolen records, and no victim organisation has issued a notification. What is documented is capability, not confirmed loss.
Two paths lead to credential theft: doppelganger domains impersonating Microsoft 365 sign-in portals, and device code phishing pages abusing the Microsoft Entra ID authentication flow. The device code flow is the more dangerous of the two, because it yields refresh tokens that survive password resets and can bypass some MFA configurations.
The third path delivers malware. CornFlake is described by Microsoft as a full-featured Windows remote access trojan written in Go. It registers as a Windows service named svchost32 with the display name "Cloud Sync Service" and the description "Synchronizes files with the cloud storage provider," deliberately mimicking the legitimate svchost.exe process, and establishes redundant persistence mechanisms. Its documented capabilities, as catalogued by The Register from Microsoft's analysis, include keylogging, clipboard monitoring, screenshot capture, audio surveillance, video surveillance, browser credential theft, file exfiltration, USB drive monitoring, a security posture sweep, and remote shell. A second family, ChocoShell, is named by Microsoft and echoed by BleepingComputer and Help Net Security, but detailed analysis of it is not present in the available reporting.
Audio and video surveillance in an implant deployed at conference venues is the detail worth dwelling on. This is not commodity infostealer behaviour.
Why It Matters
On victim profile, the sources genuinely diverge and the divergence should be stated plainly. Aggregator fasmed.eu frames this as a campaign to steal data from government officials and senior executives. That framing is not supported by the primary source. Microsoft describes targeting of travellers and hospitality-network users generally; ReliaQuest assesses the goal as accessing the accounts of corporate travellers; SecurityWeek reports the intercepted M365 credentials belonged to travelling employees in financial services, professional services, legal, healthcare, energy and retail. Government and diplomatic targeting is Midnight Blizzard's well-documented historical pattern, per SecurityWeek, but it is an inference about the actor, not a confirmed finding about this campaign.
The infrastructure question is the larger strategic concern. Microsoft wrote that its investigation into the initial compromise vector is ongoing, but that it observed "notable commonalities in the equipment and management systems used across multiple affected networks," suggesting the activity "might not be limited to isolated compromises of individual venues and could reflect access to shared services within portions of the captive portal ecosystem." In plain terms: this may not be hundreds of hacked hotels, but one or more compromised upstream providers serving them. Microsoft has not named any provider. If that hypothesis holds, the affected population is bounded by a vendor's customer list rather than by attacker effort.
Microsoft also states it observed Storm-2945 leveraging AI to support a significant portion of these operations, and credited Anthropic and OpenAI for collaboration during the investigation. Help Net Security and iTnews both characterise the broader operation as AI-assisted from February 2026 onward.
The Attack Technique
Initial access to the captive portal networks remains undetermined. Both ReliaQuest and Microsoft say so explicitly; the shared-infrastructure signal above is the strongest lead either has published.
Once positioned at the network layer, the chain is straightforward and effective. Storm-2945 manipulates DNS and HTTP traffic to place itself adversary-in-the-middle between the guest device and the internet. It abuses the automated connectivity checks that phones and laptops run when joining a new network, the same mechanism that normally pops the hotel login page, to trigger attacker-chosen prompts and redirects. Victims see one of three things: a fake Microsoft 365 login, a device code authorisation page, or a fake browser or OS update.
The malware path uses ClickFix-style social engineering, presenting fabricated driver repairs, OS updates or "web verification failures" and instructing the user to run commands themselves. CornFlake then displays what The Register quotes Microsoft as calling a "convincing" fake Windows update progress window while installing. Microsoft additionally found ClickFix landing pages configured to push an APK file, indicating Android targeting alongside Windows.
What Organizations Should Do
- Treat the device code flow as hostile by default. Restrict or disable device code authentication in Entra ID via Conditional Access for any user population that does not demonstrably need it. This single control neutralises the highest-value branch of the attack chain.
- Require phishing-resistant MFA for travelling staff. FIDO2 security keys or certificate-based authentication defeat the AitM credential proxying described in both the ReliaQuest and Microsoft reporting; TOTP and push approvals do not.
- Mandate always-on VPN before any network traffic on untrusted Wi-Fi, and disable automatic captive portal detection where the platform allows it. The connectivity-check abuse is the trigger for the entire redirect chain.
- Hunt for CornFlake persistence now. Look for a Windows service named
svchost32with the display name "Cloud Sync Service" and description "Synchronizes files with the cloud storage provider," and expect redundant persistence beyond the service registration. - Audit Entra ID sign-in logs and refresh tokens for the February 2026 onward window, not just May. The phishing phase predates the network compromises by roughly three months, and stolen refresh tokens outlive password changes. Revoke sessions for any traveller with anomalous device-code grants.
- Extend endpoint controls to Android fleets and brief executives specifically. The APK delivery path and the audio/video surveillance capability together make conference-season travel by senior staff the highest-risk exposure in this campaign.
Sources: 08:03 AM, Thu August 6: Hackers associated with Russia’s FIS breach... | CaptiveCrunch: Midnight Blizzard targets travelers worldwide for ma... | Hotel Wi-Fi attacks use custom malware to breach Microsoft 365 acco... | Russia’s SVR borks public Wi-Fis for digital surveillance | Russian State APT Linked to Recent Public Wi-Fi Gateway Hacking - S... | Russian hackers abuse hotel Wi-Fi networks to steal Microsoft 365 c... | Russia-linked "Midnight Blizzard" group hijacks hotel wi-fi with Ca... | Russian Hackers Hijack Hotel Wi-Fi to Steal Microsoft 365 Tokens