Russian SVR-Linked Hackers Intercepted Hotel WiFi Worldwide to Steal Officials and Executives Data

Microsoft Threat Intelligence reported on July 31 that a Russia-linked group it tracks as Storm-2945, a sub-cluster of Midnight Blizzard and associated with the SVR, has been intercepting DNS and HTTP traffic on hotel, conference-center, and shared-venue Wi-Fi networks worldwide since early May, with device-code and OAuth phishing activity dating to February 12. The operation, which Microsoft named CaptiveCrunch, redirects victims to fake Microsoft 365 login pages or delivers malware through spoofed browser and operating-system update prompts and ClickFix "verification" scripts 12. Microsoft identified two malware families used in the campaign: CornFlake, a Go-based remote-access trojan with keylogging, webcam and microphone surveillance, and credential-theft capabilities, and ChocoShell, a PowerShell infostealer targeting browser cookies, Microsoft 365 tokens, and Wi-Fi passwords, both controlled through an unprotected web panel called FruitStone that researchers could access directly 2. Microsoft assessed the malware was likely developed with AI assistance based on code comments found in the samples 2. BleepingComputer noted the campaign was earlier disclosed by cybersecurity firm ReliaQuest and that Microsoft has also found evidence the group is attempting to deliver malicious Android APK files 2.