--- title: Hotel Wi-Fi attacks use custom malware to breach... description: Microsoft has attributed a global campaign targeting hotel and conference center Wi-Fi networks to Russian threat actor Midnight Blizzard (APT29), tracking it... canonical: https://daily.dev/posts/hotel-wi-fi-attacks-use-custom-malware-to-breach-microsoft-365-accounts-rtlqwu6uv twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Hotel Wi-Fi attacks use custom malware to breach Microsoft 365 accounts | daily.dev og:description: Microsoft has attributed a global campaign targeting hotel and conference center Wi-Fi networks to Russian threat actor Midnight Blizzard (APT29), tracking it... og:url: https://daily.dev/posts/hotel-wi-fi-attacks-use-custom-malware-to-breach-microsoft-365-accounts-rtlqwu6uv og:image: https://api.daily.dev/og/posts/rTlqwu6Uv.png og:image:alt: Hotel Wi-Fi attacks use custom malware to breach Microsoft 365 accounts og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Hotel Wi-Fi attacks use custom malware to breach Microsoft 365 accounts **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 4 min read · 0 upvotes · 0 comments ## Summary Microsoft has attributed a global campaign targeting hotel and conference center Wi-Fi networks to Russian threat actor Midnight Blizzard (APT29), tracking it as CaptiveCrunch. The attackers manipulate DNS and HTTP traffic on captive portal equipment to redirect victims to phishing pages impersonating Microsoft 365 login portals or device code phishing pages. Two newly identified malware families are involved: CornFlake, a Go-based RAT with capabilities including keylogging, screenshot capture, webcam surveillance, and Microsoft 365 session token theft; and ChocoShell, an in-memory PowerShell credential stealer targeting browser cookies, saved passwords, and Azure AD tokens. A ClickFix technique is also used to deliver malware via fake browser/OS update pages. Microsoft also uncovered an unprotected management panel called FruitStone used to control infected systems. Mitigations include treating hotel Wi-Fi as untrusted, using phishing-resistant MFA, and disabling Entra device code authentication when not needed. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Schneier on Security](https://daily.dev/posts/schneier-on-security-voqfhigtw) · Schneier on Security · 0 upvotes · 0 comments - [Large-Scale ClickFix Phishing Attacks Target Hotel Systems with PureRAT Malware](https://daily.dev/posts/large-scale-clickfix-phishing-attacks-target-hotel-systems-with-purerat-malware-kc5f9td6d) · The Hacker News · 0 upvotes · 0 comments - [Malware Campaign Abuses Booking.com Against Hospitality Sector](https://daily.dev/posts/malware-campaign-abuses-booking-com-against-hospitality-sector-fgjly8xvz) · Security Boulevard · 1 upvotes · 0 comments - [Hotel staff tricked into installing malware by bogus BSODs](https://daily.dev/posts/hotel-staff-tricked-into-installing-malware-by-bogus-bsods-ly6vduz7o) · The Register · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#microsoft](https://daily.dev/tags/microsoft), [#malware](https://daily.dev/tags/malware), [#phishing](https://daily.dev/tags/phishing) [View this post on daily.dev](https://daily.dev/posts/hotel-wi-fi-attacks-use-custom-malware-to-breach-microsoft-365-accounts-rtlqwu6uv) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Hotel Wi-Fi attacks use custom malware to breach Microsoft 365 accounts","url":"https://daily.dev/posts/hotel-wi-fi-attacks-use-custom-malware-to-breach-microsoft-365-accounts-rtlqwu6uv","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/hotel-wi-fi-attacks-use-custom-malware-to-breach-microsoft-365-accounts-rtlqwu6uv"},"datePublished":"2026-08-04T00:22:10.673Z","dateModified":"2026-08-04T00:23:12.582Z","description":"Microsoft has attributed a global campaign targeting hotel and conference center Wi-Fi networks to Russian threat actor Midnight Blizzard (APT29), tracking it...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a2b8a24d25aebd2f7ae96724f87d50d4?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a2b8a24d25aebd2f7ae96724f87d50d4?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/hotel-wi-fi-attacks-use-custom-malware-to-breach-microsoft-365-accounts-rtlqwu6uv","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,microsoft,malware,phishing","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"Hotel Wi-Fi attacks use custom malware to breach Microsoft 365 accounts"}]} ```