Hotel Wi-Fi attacks use custom malware to breach Microsoft 365 accounts
A global campaign targeting hospitality Wi-Fi networks has been linked to the Russian threat actor Midnight Blizzard. The attackers use custom malware to steal Microsoft 365 accounts and have been active since at least early May.
Intelligence analysis by Llama
A global campaign targeting hospitality Wi-Fi networks has been linked to the Russian threat actor Midnight Blizzard. The attackers use custom malware to steal Microsoft 365 accounts and have been active since at least early May. The malware, called CornFlake and ChocoShell, has capabilities for persistent access, credential theft, surveillance, and data exfiltration.
Imagine you're at a hotel and you connect to their Wi-Fi. But what if someone was able to hack into that Wi-Fi and steal your password? That's what's happening in this case. The hackers are using special malware to steal people's Microsoft 365 accounts, which can give them access to all sorts of sensitive information.
Analysis
A Global Campaign of Hotel Wi-Fi Attacks
A global campaign targeting hospitality Wi-Fi networks has been linked to the Russian threat actor Midnight Blizzard. The attackers use custom malware to steal Microsoft 365 accounts and have been active since at least early May. The malware, called CornFlake and ChocoShell, has capabilities for persistent access, credential theft, surveillance, and data exfiltration.
The attackers manipulate DNS and HTTP traffic on networks served by captive portal equipment, allowing them to intercept user connections to hotel and conference center Wi-Fi networks. They then redirect victims to phishing pages that impersonate Microsoft 365 login portals or to device code phishing pages that abuse Microsoft Entra ID authentication flows.
Microsoft observed this activity since July and found evidence in some ClickFix landings indicating that the threat actor is also targeting Android devices to deliver an APK file. The attackers use fake browser and operating system update pages that deliver malware to Windows via ClickFix prompts for user verification.
The Malware Families
Microsoft analyzed the two new Windows malware families and found that CornFlake is a Go-based remote access trojan (RAT) that offers the following capabilities: remote shell access, keylogging, clipboard monitoring, screenshot capturing, microphone and webcam surveillance, browser credential and cookie theft, Microsoft 365 session token theft, and file exfiltration.
When executed, CornFlake shows a fake progress window to distract the user while the binary copies to %AppData% for persistence. The bogus window can be configured to appear as a Windows update screen, a Defender virus scan, a disk optimization utility, a network diagnostics tool, a browser update prompt, or a document viewer installer.
CornFlake disguises itself as “Cloud Sync Service” to appear as a legitimate Windows component, and uses multiple persistence mechanisms on the host, including Windows service registrations, registry run keys, named tasks, and a watchdog routine designed to restore any of the available persistence mechanisms.
The second payload, ChocoShell, is an in-memory PowerShell credential stealer that targets browser cookies, saved passwords, Microsoft 365 and Azure AD tokens, and Wi-Fi credentials.
The Attack Chain
Based on the extensive comments in the code, Microsoft assesses that AI tools were likely used to develop the two pieces of malware. The researchers also discovered an unprotected web-based management panel named FruitStone that the threat actor used to handle infected systems, browse victim files, execute PowerShell commands, and capture screenshots and keystrokes.
Microsoft recommends treating hotel and conference Wi-Fi as untrusted, using private cellular or managed connections whenever possible, and avoiding software updates or tools offered through captive portals. It is also recommended to adopt phishing-resistant authentication with MFA and passkeys, disable Microsoft Entra device code authentication when not needed, and avoid using corporate credentials to register for guest Wi-Fi networks.
Key points
- A global campaign targeting hospitality Wi-Fi networks has been linked to the Russian threat actor Midnight Blizzard.
- The attackers use custom malware to steal Microsoft 365 accounts and have been active since at least early May.
- The malware, called CornFlake and ChocoShell, has capabilities for persistent access, credential theft, surveillance, and data exfiltration.
- Microsoft recommends treating hotel and conference Wi-Fi as untrusted, using private cellular or managed connections whenever possible, and avoiding software updates or tools offered through captive portals.
If this development plays out positively, it could lead to increased awareness and security measures being taken by hotels and conference centers to protect their guests' data. This could include implementing more robust security protocols, such as two-factor authentication, and providing guests with more information about the security risks associated with public Wi-Fi networks.
The realistic downside risks or failure modes of this development include the potential for widespread data breaches, financial losses, and reputational damage for hotels and conference centers. Additionally, the use of AI tools to develop the malware could make it more difficult to detect and prevent future attacks.
