Hijacked Hotel Wi-Fi Pushes Fake Updates to Deliver Surveillance Malware
Summary: A fake browser update served over hijacked hotel Wi-Fi delivered CornFlake, a Go-based remote access trojan that captures webcam images, microphone audio, and keystrokes, according to a Microsoft report. Microsoft tracks the operation as CaptiveCrunch and attributes it to Storm-2945, which it assesses to be an operational sub-cluster of Midnight Blizzard (APT29), the actor the U.S. and U.K. governments attribute to Russia's Foreign Intelligence Service. On compromised networks ReliaQuest investigated, the captive portal gateway also served as the DNS resolver, letting attackers forge DNS answers and redirect a laptop's automatic connectivity check to a fake update, though the victim still had to download or execute the payload.
What's compelling: Since July 16, some CaptiveCrunch landing pages have redirected guests into Microsoft's device code authentication flow, where entering an attacker-supplied code on Microsoft's legitimate sign-in page can grant an attacker-controlled session MFA-satisfied access. Microsoft found common equipment and management systems across affected networks, which it says could mean the compromises were not isolated to individual venues.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026