Hotel Wi-Fi Attacks Deploy Custom Malware to Compromise Microsoft 365 Accounts
In May 2026, Microsoft identified a sophisticated cyberattack campaign, dubbed 'CaptiveCrunch,' targeting hotel and conference center Wi-Fi networks globally. Attributed to the Russian state-sponsored group Midnight Blizzard (APT29), the attackers compromised captive portal equipment to manipulate DNS and HTTP traffic. This allowed them to redirect users to phishing pages mimicking Microsoft 365 login portals, leading to credential theft. Additionally, they deployed custom malware families, CornFlake and ChocoShell, enabling persistent access, surveillance, and data exfiltration. This incident underscores the evolving tactics of nation-state actors in exploiting trusted public networks to infiltrate corporate environments. The use of custom malware and advanced phishing techniques highlights the need for heightened vigilance and robust security measures when accessing corporate resources over public Wi-Fi.
Kill Chain