**Hackers Hijack Hotel Wi-Fi to Deliver CornFlake RAT via Fake Browser Updates**
*By Swati Khandelwal, August 1, 2026*
*Tags: Malware / Cyber Espionage*
A sophisticated cyber-espionage operation has been uncovered, in which attackers hijacked hotel Wi-Fi networks to deliver a dangerous remote access trojan (RAT) disguised as a fake browser or operating system update. Microsoft’s latest report details the campaign, dubbed “CaptiveCrunch,” which has been actively targeting hospitality networks across multiple countries since May 2026.
The operation, attributed to the Russian state-sponsored group Storm-2945 (a sub-cluster of the notorious APT29, also known as Midnight Blizzard or Cozy Bear), leverages compromised captive portal gateways to manipulate DNS settings. Attackers redirect victims attempting to connect to the internet, serving them fraudulent update pages.
According to Microsoft, once a victim interacts with the fake update, the CornFlake RAT is deployed. This implant is capable of extensive surveillance, including capturing webcam images, recording microphone audio, stealing keystrokes, and exfiltrating sensitive data like browser cookies and saved passwords. The malware employs persistence mechanisms, such as Registry Run keys and scheduled tasks, to maintain control even if parts of it are removed.
A particularly concerning aspect of the attack is the use of “ClickFix” social engineering tactics, where victims are instructed to open a terminal or run specific commands, making the malicious process appear legitimate. Furthermore, some victims are redirected to Microsoft’s legitimate device authentication flow, where entering a provided code grants the attacker MFA-satisfied access to the victim’s session.
**Key Takeaways & Recommendations:**
* **Attribution:** The campaign is linked to Storm-2945, assessed by the U.S. and U.K. governments as part of Russia’s Foreign Intelligence Service (SVR).
* **Method:** Attackers compromise hotel Wi-Fi captive portals to serve fake software updates.
* **Payload:** The CornFlake RAT enables comprehensive spying, including webcam hijacking, keystroke logging, and credential theft.
* **Mitigation:** Security experts strongly advise travelers to use a trusted, always-on, full-tunnel VPN and to never accept software updates or authentication requests presented through captive portal pages.
—
### FAQ
**Q: What is the “CaptiveCrunch” operation?**
A: CaptiveCrunch is a cyber-espionage campaign where attackers hijack hotel Wi-Fi networks to redirect users to fake browser or OS update pages. These pages deliver the CornFlake remote access trojan (RAT).
**Q: Who is behind this attack?**
A: The operation is attributed to Storm-2945, a sub-cluster of the Russian APT29 (Cozy Bear, Midnight Blizzard) group, which is itself designated as part of Russia’s Foreign Intelligence Service (SVR).
**Q: What makes this attack method particularly dangerous?**
A: The attackers manipulate the captive portal’s DNS settings to control where a user’s traffic is sent. The victim must still take an action, like clicking a fake update prompt, but the process is heavily social engineered. The payload, CornFlake, is a sophisticated RAT that can spy on the user’s activities and steal sensitive data.
**Q: How can travelers protect themselves?**
A: The primary recommendation is to use a personal, always-on, full-tunnel VPN, which encrypts all traffic and routes DNS queries through a trusted corporate or personal resolver before reaching the venue’s network. Travelers should also be vigilant and never install software or enter credentials via prompts served through a hotel’s captive portal.
**Q: Has any specific hotel or vendor been named?**
A: No. Microsoft and the researchers have not disclosed the names of any specific hotels, venues, or captive portal vendors involved in these incidents.
—
### Conclusion
The CaptiveCrunch operation represents a stark reminder of the security risks inherent in using public Wi-Fi networks, especially in high-traffic areas like hotels. By weaponizing the trusted process of software updates, attackers have found a potent vector for espionage. While the findings are attributed to a sophisticated nation-state actor, the core lesson is universal: untrusted networks are inherently insecure. The most effective defense for individuals is to assume that any portal-based interaction on public Wi-Fi is a potential threat and to rely on personal, encrypted connections via a VPN to maintain privacy and security.
