Recent investigations have uncovered a sophisticated cyber espionage campaign targeting hotel Wi-Fi networks to distribute surveillance malware. Attackers have compromised these networks to serve fake browser updates, leading unsuspecting guests to install a remote access trojan (RAT) known as CornFlake. This malware is capable of capturing webcam images, recording microphone audio, and logging keystrokes.
Security researchers have identified this operation as CaptiveCrunch, attributing it to the threat actor Storm-2945. This group is believed to be an operational sub-cluster of Midnight Blizzard, also known as APT29 or Cozy Bear, which has been linked to Russia’s Foreign Intelligence Service (SVR).
The attack method involves hijacking the captive portal gateways of hotel Wi-Fi networks. These gateways, which manage guest access to the internet, also function as DNS resolvers. By gaining administrative control over these gateways, attackers can manipulate DNS responses, redirecting users to malicious sites that prompt them to download fake browser or operating system updates. Some of these malicious pages employ ClickFix techniques, instructing users to execute specific commands in their system terminals, thereby facilitating the installation of the malware.
Microsoft’s analysis reveals that CornFlake, written in Go, installs itself in the %APPDATA%\svchost32\ directory and registers as a service named “Cloud Sync Service.” During installation, it displays a fake progress window to deceive the user. Once active, CornFlake can perform various surveillance activities, including taking screenshots when the system is idle, recording clipboard contents along with active window titles, stealing browser cookies and saved passwords (even those protected by Chrome’s App-Bound Encryption), scanning removable media, and opening a remote shell. To maintain persistence, it utilizes registry run keys and scheduled tasks, with a watchdog mechanism to restore any removed persistence methods.
Additionally, researchers have identified another tool named ChocoShell, an in-memory PowerShell-based credential stealer. ChocoShell targets Microsoft 365 and Azure Active Directory access and refresh tokens, as well as Web Account Manager (WAM) tokens, by extracting them from .tbres files in the Token Broker cache. These stolen tokens can be used for session replay attacks without the need for browser cookies.
To mitigate the risks associated with such attacks, travelers are advised to use private internet connections and avoid accepting software updates, certificates, browser updates, troubleshooting tools, or security utilities offered through captive portals. Implementing an always-on, full-tunnel virtual private network (VPN) is recommended, as it routes DNS queries through corporate resolvers before they reach the venue’s gateway, reducing the likelihood of DNS manipulation.
Since mid-July, some CaptiveCrunch landing pages have been observed redirecting users to Microsoft’s device code authentication flow. By entering an attacker-supplied code on Microsoft’s legitimate sign-in page, victims can inadvertently grant attackers multi-factor authentication (MFA)-satisfied access. To counter this, Microsoft recommends blocking the device code authentication flow through Conditional Access policies where it is not necessary.
These findings underscore the evolving tactics of cyber espionage groups and the importance of maintaining robust cybersecurity practices, especially when connecting to public or semi-public networks like those in hotels. Travelers should remain vigilant and adopt proactive measures to safeguard their personal and professional data from such sophisticated threats.
