CaptiveCrunch: Russian APTs Target Travelers via Wi-Fi Hijacking

Microsoft and partner researchers have identified a global campaign dubbed 'CaptiveCrunch,' attributed to Storm-2945, a sub-cluster of the Russian state-sponsored actor Midnight Blizzard (APT29). The campaign targets travelers by compromising hospitality sector Wi-Fi networks and guest portals. The attackers position themselves in the network path to manipulate DNS and HTTP traffic, transforming routine connectivity checks into opportunities for credential theft and malware delivery.

Technically, the actor utilizes Adversary-in-the-Middle (AitM) tactics to redirect users to phishing pages or trigger 'ClickFix' social engineering prompts. These prompts trick victims into running commands that install CornFlake, a Go-based remote access trojan (RAT), or ChocoShell, a fileless PowerShell infostealer. The campaign is notable for its use of AI-assisted code generation and its focus on bypassing modern security features like Google Chrome's App-Bound Encryption and Microsoft Entra ID authentication flows.

This activity poses a high risk to corporate travelers and executive personnel. By compromising the underlying network infrastructure of hotels and conference centers, the attackers can bypass traditional perimeter defenses to harvest high-value Microsoft 365 session tokens and sensitive internal documents, facilitating long-term espionage.