What happened (a.k.a. don’t plug in and relax)

Travel tip: that free hotel or conference Wi‑Fi might be a trap. Security researchers at a major vendor tied a global campaign to a Russian threat group (you might see names like Midnight Blizzard or APT29). Attackers were quietly meddling with network gear that handles captive portals, then twisting traffic so visitors get pushed to sneaky pages or fake updates.

The trick is simple but effective: after changing network DNS and HTTP behavior, victims are rerouted to look‑alike login screens that pretend to be Microsoft 365 sign‑ins or to pages that abuse device code flows. Another twist sends fake browser/OS update prompts that drop malware through a ClickFix-style installer. Some landings even attempted to deliver APKs for Android phones.

The tools and the fallout (meet the uninvited guests)

Microsoft’s analysis named two main Windows payloads. One is a Go-built remote access trojan that’s loud in capability but quiet in appearance; the other is an in-memory PowerShell credential stealer. The researchers also found an exposed management panel that the attackers used to control infected machines and browse victim files.

  • CornFlake — a Go-based RAT that hides behind a fake progress/update window while it copies itself to %AppData% for persistence. It likes to masquerade as legitimate services and installs multiple backups (services, registry run keys, scheduled tasks and a watchdog) so it keeps coming back even if you try to evict it.
  • ChocoShell — an in-memory PowerShell tool that quietly grabs browser cookies, saved passwords, Entra/Azure tokens and Wi‑Fi credentials, then ships them off to the attackers.

CornFlake’s feature set reads like a villain’s wishlist. It can:

  • Open remote shells
  • Log keystrokes and copy clipboard contents
  • Take screenshots and access microphones/webcams
  • Harvest browser credentials, cookies, and session tokens
  • Exfiltrate files and monitor USB activity
  • Run system reconnaissance

Interestingly, the code contained lots of comments that suggest the authors leaned on AI coding tools during development. The attackers also used an unprotected web panel (nicknamed FruitStone by researchers) to manage infections — browse files, execute commands, grab screenshots and more — which made their operation easier to run at scale.

Microsoft observed these techniques being used since early spring, with related phishing tricks going back a bit further. The initial breach path into shared infrastructure is still murky, but the key point is that when the network itself is compromised, every guest is at risk.

Quick, useful survival tips:

  • Treat public hotel and conference Wi‑Fi as untrusted. If possible, use your phone’s hot spot or a managed VPN service.
  • Never install updates or tools offered through captive portals — legitimate vendor updates don’t arrive via a hotel login page.
  • Enable phishing‑resistant sign‑in methods like MFA with passkeys where available, and avoid using corporate creds for guest Wi‑Fi registrations.
  • Disable device-code authentication flows (Entra/Azure) if you don’t need them, or at least be extra cautious when prompted to authorize devices.
  • Defenders: test your detection layers — these attackers rely on persistence and stealth, so assume the network layer can be weaponized.

Short version: if the Wi‑Fi looks too convenient, assume it’s suspicious. Keep credentials safe, updates official, and your devices on trustworthy networks whenever you can. Oh — and don’t accept surprise update prompts from a captive portal, no matter how convincing the progress bar looks.