Loading story…
Attackers have been compromising captive portal and hotel Wi-Fi gateway appliances, then changing DNS settings to redirect connected guests to attacker-controlled infrastructure that impersonates Microsoft 365 sign-in pages. ReliaQuest said the activity has hit hotels, conference centers, and similar shared venues in multiple U.S. cities as well as India and Saudi Arabia, affecting travelers from sectors including finance, legal, healthcare, energy, and retail. The campaign uses lookalike domains such as m365-owa.com, owa-ms365.com, ms365-device.com, and ms365-live.com to harvest credentials or lure users into Microsoft device code authentication flows.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
In the observed campaign, attackers used Microsoft-themed domains and in some cases abused Microsoft device code authentication flow to obtain OAuth tokens and MFA-satisfied access to Microsoft 365. In about one-third of investigated cases, they also attempted to exploit WPAD to force Windows devices to fetch malicious proxy auto-configuration files and route traffic through attacker-controlled proxies.
ReliaQuest reported that attackers have been compromising captive portal and hotel Wi-Fi gateway appliances at hotels and conference centers, altering DNS settings to redirect users to attacker-controlled Microsoft 365 phishing infrastructure. The activity has been active since at least June and has been observed in multiple U.S. cities as well as India and Saudi Arabia, affecting travelers across several sectors.
Since July 16, 2026, some CaptiveCrunch landing pages began abusing Microsoft's legitimate device code authentication flow, prompting victims to enter a code on the real sign-in page and authenticate the attackers' session, including MFA completion. Microsoft said this expanded the campaign beyond fake update delivery and credential theft to token-focused account compromise.
Microsoft Threat Intelligence reported that since early May 2026, Storm-2945—assessed as a sub-cluster of Russia-linked Midnight Blizzard—has run the CaptiveCrunch campaign by manipulating captive-portal network traffic to phish travelers and deliver malware. Microsoft also disclosed the CornFlake Windows RAT and ChocoShell PowerShell infostealer as malware used in the operation.
Microsoft reported that attackers controlling hospitality captive portals redirected connectivity checks to fake browser or operating system update pages that tricked victims into downloading and executing the CornFlake RAT. Microsoft said it had observed this traffic-manipulation and malware-delivery activity across hospitality networks in several countries since early May 2026.
Lumen Black Lotus Labs published research on a DNS hijacking campaign dubbed FrostArmada and linked it to Forest Blizzard. The report represents an earlier public disclosure of activity related to the captive-portal and DNS-manipulation tradecraft later covered in the existing timeline.
Microsoft disclosed that the CornFlake RAT and CocoShell/ChocoShell PowerShell infostealer used in the CaptiveCrunch campaign communicated with a previously unseen command-and-control panel called FruitStone. This added new technical detail about the campaign's malware infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
18 references tracked. Mallory keeps watching after this page renders.
blog.knowbe4.com
Open sourceinfosecurity-magazine.com
Open sourcenews.risky.biz
Open sourcesecurityaffairs.com
Open sourcereliaquest.com
Open sourcelumen.com
Open sourcevolexity.com
Open sourcencsc.gov.uk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft Threat Intelligence and Zscaler reported that **Storm-2945**, a sub-cluster of **Midnight Blizzard / APT29** linked to Russia, has been compromising shared captive-portal infrastructure at hotels, conference centers, and similar venues to intercept traveler traffic and steal **Microsoft 365** credentials. The operation, dubbed **CaptiveCrunch**, manipulates DNS and HTTP flows to redirect victims from legitimate Wi-Fi login pages to attacker-controlled phishing and malware-delivery sites, including lures for **Microsoft Entra ID device code phishing** and **ClickFix-style** fake updates. Activity has been observed in multiple U.S. cities as well as India and Saudi Arabia, indicating a broad campaign aimed at travelers across sectors. Researchers said the campaign deploys multiple payloads after credential theft, including **CornFlake**, a Go-based Windows RAT used for persistence and surveillance, and **ChocoShell**, an in-memory PowerShell stealer designed to collect browser secrets, Microsoft 365 and Azure AD/WAM tokens, and Wi-Fi credentials. The operation has also expanded to Android through malicious APKs, and Microsoft assessed that AI-assisted tooling supported parts of the intrusion set, including development of CornFlake and ChocoShell. The reporting indicates the attackers are using trusted hospitality network infrastructure as an initial access vector to harvest identities and extend compromise onto victim devices.
Aug 17, 2026
Microsoft linked the **CaptiveCrunch** campaign to **Storm-2945**, a subgroup of the Russian state-backed **Midnight Blizzard** actor, after attackers compromised captive portal ecosystems used by hospitality organizations and other shared public venues. By manipulating **DNS** and **HTTP** traffic on public Wi-Fi gateway infrastructure, the group conducted **adversary-in-the-middle (AiTM)** attacks that intercepted login flows and stole **Microsoft 365** credentials from traveling employees across multiple sectors. The operation also pushed follow-on malware and phishing lures through the hijacked portals. Victims were shown fake browser update prompts delivering malware including **CornFlake** and **ChocoShell**, alongside **ClickFix**-style social engineering and malicious Android **APK** prompts; some recent landing pages also added **device code phishing**, a technique Microsoft said Midnight Blizzard has used since 2024. The campaign has reportedly been active since May and focused on hospitality-linked networks and other public access environments where users expect captive portal authentication.
Aug 6, 2026
A sophisticated, multi-stage phishing campaign has been observed targeting organizations globally to steal Microsoft 365 credentials. The operation, monitored since early November 2025, employs advanced evasion techniques such as nested PDFs, use of legitimate content delivery networks, and mouse tracking to bypass secure email gateways and multi-factor authentication. The final credential harvesting site is engineered to block security tools and analysts, and leverages legitimate Microsoft infrastructure to circumvent MFA, granting attackers immediate access to compromised accounts. These attacks highlight the increasing complexity of phishing operations and their ability to evade traditional security controls. In parallel, threat actors are exploiting free cloud hosting platforms like Cloudflare Pages to host convincing phishing portals impersonating banking and healthcare providers. These sites not only harvest credentials but also collect additional security information, such as answers to secret questions, and exfiltrate data via Telegram bots to evade detection. Attackers use compromised legitimate domains as redirectors, increasing the likelihood of bypassing spam filters and making takedown efforts more challenging. The convergence of advanced phishing techniques and abuse of trusted cloud services underscores the need for enhanced detection and response strategies for organizations relying on Microsoft 365 and similar platforms.
Jun 29, 2026