CaptiveCrunch Exploits Hospitality Wi-Fi

Travelers connecting to public internet infrastructure face a growing risk as threat actors leverage compromised captive portals to deliver sophisticated malware. By gaining administrative control over network gateways, attackers can intercept traffic and manipulate domain resolution to redirect unsuspecting users toward malicious payloads disguised as routine system updates.

Gateway Manipulation and Traffic Redirection

The operation, tracked by researchers as CaptiveCrunch, targets the DNS resolution process inherent in many hospitality environments. Because the captive portal gateway often functions as the designated DNS resolver for connected devices, unauthorized access allows for the injection of forged DNS responses. This redirection steers a user's automatic connectivity check toward attacker-controlled infrastructure, enabling the distribution of a remote access trojan identified as CornFlake.

While the gateway controls the initial redirection, successful compromise is not automatic. Victims are often presented with ClickFix instructions, which prompt them to open a terminal or execute specific Windows utilities to run attacker-provided commands. This social engineering component remains a necessary step for the final installation of the malware.

Credential Theft and Session Hijacking

Since July 16, the campaign has expanded to include the abuse of legitimate authentication mechanisms. In some instances, landing pages redirect guests into a device code authentication flow. By entering provided codes on a legitimate Microsoft sign-in page, users inadvertently provide the attackers with MFA-satisfied session access.

Furthermore, researchers identified an in-memory PowerShell tool called ChocoShell. This component targets access and refresh tokens for Microsoft 365 and Azure Active Directory, as well as Web Account Manager tokens, directly from the system's Token Broker cache. The recovery of these tokens allows for session replay without the need for traditional browser cookies.

• Initial traffic manipulation observed since early May.
• Operation CaptiveCrunch linked to Storm-2945.
• ChocoShell targets tokens stored in .tbres files.
• ReliaQuest documented the infrastructure eight days prior to the Microsoft report.
• Similarities noted to Microsoft's analysis of recent activity.

Infrastructure and Attribution

Microsoft researchers have linked the activity to Storm-2945, an operational sub-cluster of the group known as Midnight Blizzard or APT29. The U.S. and U.K. governments maintain that APT29 operates under the Russian Foreign Intelligence Service. While the tactics bear a resemblance to the Forest Blizzard router hijacking documented in April, attribution for CaptiveCrunch remains tied specifically to the Microsoft assessment of Storm-2945.

The underlying cause of the network compromises remains under investigation. While the shared use of specific management systems across hospitality networks suggests a potential vulnerability in the broader ecosystem, independent corroboration of these findings has not yet been published.

Implications for Network Security

This campaign underscores the inherent vulnerabilities of trusting captive portals provided by public venues. Because the gateway possesses the authority to resolve DNS queries, it can effectively blind a user to traffic interception. For professionals and business travelers, the primary defense involves removing reliance on the local network's DNS infrastructure. Implementing an always-on, full-tunnel VPN ensures that all traffic is routed through trusted corporate resolvers, bypassing the local gateway's ability to forge responses and redirect users to malicious landing pages.