- › Microsoft reports that a Russian actor has compromised hospitality sign-in portals since May 2026 to deliver malware and steal credentials from travelers.
- › The captive portal is effective because every traveler has been trained to accept a strange page in order to get online.
- › Some landing pages redirect into an attacker-controlled device code flow, so the victim approves the adversary's session without typing a password anywhere.
- › The payload, CornFlake, captures keystrokes, screen, microphone, camera, browser credentials, and files, and it reinstalls its own persistence when you remove it.
- › The fix is mostly configuration you already own: always-on VPN or Security Service Edge, blocked device code flow, phishing-resistant MFA, and a policy that says nobody joins guest Wi-Fi directly.
Picture the last leg of a business trip. Your sales lead lands at 11pm, checks in, gets to the room, and opens a laptop to send one email before sleeping. The hotel Wi-Fi throws up a sign-in page asking for a room number and a last name. They type them. A second page says the browser needs an update before it can continue. They have seen that page in some form at four hotels this year. They click it.
That is the whole attack. Microsoft published research on July 31 describing an operation it calls CaptiveCrunch, run by Storm-2945, a sub-cluster of the Russian actor Midnight Blizzard. Since May 2026 the group has been compromising the sign-in portals of hotels, conference centers, and shared venues across several countries, then using that position to push malware and harvest credentials from corporate travelers.
The placement is the interesting part. Forget the malware for a moment and look at where they chose to stand.
The One Page Nobody Is Allowed to Refuse
Every security awareness program in the world teaches people to be suspicious of unexpected pages that ask for information. Then we hand those same people a travel policy that requires them to accept an unexpected page that asks for information, roughly twice a week, in order to do their jobs.
A captive portal is a page that intercepts your traffic before you have internet access. Think of it as the toll booth on the only road into town. Everyone slows down, everyone hands something over, and nobody questions the booth because the road does not work any other way. Put an adversary in the booth and every car that day is theirs.
The portal is supposed to look unfamiliar. It is supposed to ask for details you would not normally give a website. It is supposed to appear without you navigating to it. Every single property that would make a security-aware person close the tab is a normal, expected property of a captive portal.
Now put yourself in the adversary’s position. You want a foothold on machines belonging to people who travel for work, which is a decent proxy for people who have access worth having. You could send phishing mail into a hardened enterprise mail gateway and fight filters, reputation scoring, and a workforce that has been trained on your tactics. Or you could take a position on the one page those people have been trained to accept without thinking, at the hour of the day when they have the least judgment available.
Microsoft’s investigation into the initial compromise is still open, but it noted something important: the affected networks share commonalities in equipment and management systems. That points at shared captive portal ecosystem services rather than a burglary at each individual hotel. One supplier compromise gives an attacker a position on many properties at once, which is the same supply chain math that makes dependency and vendor compromise so cost-effective on the software side.
What the Traveler Actually Sees
The chain runs in stages. First, DNS and HTTP manipulation routes traffic through infrastructure the attacker controls. Then the victim gets a phishing page, usually a fake browser or operating system update prompt, built on ClickFix technique: instructions telling the user to “manually repair” the problem by pasting a command into Windows Terminal.
That should sound familiar, because it is the same pattern we wrote about in ClickFix and why careful employees paste malicious commands. The user does the work. The attacker burns no exploit and no vulnerability, and the endpoint sees a human choosing to run a command in a terminal.
The download masquerades as a Windows Update, a DirectX component, or a Visual C++ redistributable. Anyone who has maintained a Windows fleet has installed all three legitimately, which is exactly why they were chosen.
Some landing pages skip the malware and redirect the victim into an attacker-controlled device code authentication flow. Device code flow exists so you can sign in on a smart TV or a printer, where typing a password is painful. You get a short code, you go to a normal Microsoft sign-in page on your phone, and you approve it. In this attack the victim approves the adversary’s session. The password is never typed on a fake page, the sign-in happens on the real Microsoft domain, and multifactor authentication is satisfied by the legitimate user. There is nothing for a credential-phishing detection to catch, which is why device code phishing went from red-team trick to volume attack in under six months.
The Blast Radius of One Accepted Prompt
The persistent implant is CornFlake, a Go-based remote access trojan that presents itself as a “Cloud Sync Service” and shows a fake progress bar while it settles in.
Read its capability list as an inventory of what you just lost: keylogging, clipboard monitoring, screenshots, microphone and camera capture, browser credential theft from Chrome, Edge, and Firefox including a bypass for App-Bound Encryption, file exfiltration covering documents, archives, email, and encryption keys, USB drive monitoring, and remote shell access. It also collects security posture information across 18 intelligence categories, which means it is profiling your defenses before deciding what to do next.
Persistence runs through a Windows service, registry Run keys, and scheduled tasks, with a watchdog routine that restores whatever you remove. Cleaning one of those and calling the machine remediated is the same mistake as rotating credentials and calling the account evicted.
Run the economics. Whatever your organization spends per employee per year on endpoint protection, identity tooling, and awareness training, this attack costs the adversary a position on a shared hospitality platform, one convincing update page, and a payload they already own. Attackers behave like rational operators with a cost structure, and the hotel lobby is currently the cheapest entry point into a corporate laptop that a defender has spent five figures hardening everywhere else.
What to Actually Change
Most of this is configuration you already own. None of it requires a new product line.
Stop connecting to guest Wi-Fi directly. Company-issued mobile hotspots are the cleanest answer for staff who travel regularly, and the cost per traveler is trivial against the alternative. Where that is not practical, require an always-on virtual private network (VPN) or a Security Service Edge that establishes the tunnel before anything else touches the network. Microsoft’s own guidance is to prefer hotspots and prevent connections that were not provisioned through mobile device management.
Block device code flow. Unless you have a documented business need for shared devices that cannot accept a password, turn it off in Conditional Access. If you do need it, scope it to the specific devices and users who require it. This one control removes an entire leg of the attack chain and costs nothing.
Move to phishing-resistant MFA. Passkeys and FIDO2 security keys bind the authentication to the origin, so a proxied or redirected sign-in does not produce a usable token. Push-approval MFA does not survive an attack where the user is being asked to approve something that looks legitimate.
Restrict who can run what off the corporate network. If a laptop in a hotel room can install an unsigned “DirectX update” from a captive portal, that is an application control gap, not a user error. Application control and constrained language mode on Windows Terminal both cut the ClickFix leg.
Give travelers a specific rule. “Be careful on public Wi-Fi” does not change what someone does at 11pm. “A hotel network will never ask you to update your browser, and it will never ask you to paste a command into a terminal. If you see that, disconnect and use your hotspot” is a rule someone can follow at 11pm. Pair it with the practical guidance in our hotel room security checklist and the broader travel security essentials so the digital and physical sides of a trip are covered by one briefing.
Never reuse corporate credentials on a hotel registration page. Room number and surname are fine. A work email and its password are a gift.
The Part That Does Not Patch
You can ship every control above by the end of next week and still have the underlying condition: your people have to join networks they do not control, in places they do not control, at the end of days that have already spent their judgment. Call that a design constraint of doing business in the physical world rather than a training failure, which is why executive and traveling-staff protection has to treat the laptop and the room as one problem.
Midnight Blizzard skipped the clever bug. They took a position on a page our own policies require our people to say yes to.
Check your Conditional Access settings for device code flow this afternoon. It takes about ten minutes and it closes the leg of this attack that your endpoint tooling cannot see.
If you want a clear picture of where your people are exposed before an adversary maps it for you, take our free Human Attack Surface Score assessment, or contact us to talk through a converged assessment of your travel and remote access posture.
Sources
- Microsoft Security Blog, “CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft”, July 31, 2026.
- The Hacker News, “Hijacked Hotel Wi-Fi Pushes Fake Updates to Deliver Surveillance Malware”, August 1, 2026.
- The Hacker News, “6 Reasons Why Device Code Phishing is the Fastest-Growing Threat of 2026”, July 31, 2026.
Operating on the philosophy that 'you can't build a secure system if you don't know how to break it,' Chris leads our engineering division. A top 1% National Cyber League competitor, he hardens our digital infrastructure against the very exploits he has mastered.
View Author Page →
