SVR Hijacks Hotel Wi‑Fi to Push Malware

How the Attack Worked

Microsoft attributes this campaign to Storm-2945, a group linked to Russia's SVR and tracked as Midnight Blizzard. The operation targets public Wi-Fi users in hospitality venues such as hotels and conference centers. After compromising a location's captive portal, the attackers manipulate DNS and HTTP traffic to reroute connecting users through attacker-controlled infrastructure, a classic adversary-in-the-middle setup that sits between the victim and the internet.

Once redirected, victims see ClickFix-style prompts disguised as OS updates, driver repairs, or web verification failures. Following the prompt's instructions can install malware, primarily on Windows machines, though Microsoft has also seen Android-tailored prompts urging users to sideload an APK file. The malware families observed include CornFlake, a persistent remote access trojan, and ChocoShell, an in-memory infostealer that harvests cookies, passwords, SSO tokens, and Wi-Fi credentials.

A second track uses device code phishing. Some redirected pages instruct users to copy a code, open a legitimate Microsoft authentication page, and enter that code to "connect." Completing this flow authenticates the attacker into the chosen account, handing over a valid OAuth token for the victim's Microsoft 365 account.

Why It Succeeded

The attack exploits the routine trust travelers place in hotel and conference Wi-Fi. A prompt to "fix" connectivity or verify identity feels like a normal part of getting online, so it doesn't trigger the same suspicion an unsolicited email might. Because the compromise happens at the network level, the malicious redirect can appear consistent with the venue's own portal, making it harder for a typical user to distinguish it from a legitimate step.

The device code flow is especially effective because the authentication itself happens on a genuine Microsoft page. Victims are not entering credentials into a fake site, they are completing a real sign-in, just one initiated by an attacker rather than themselves.

What to Watch For

• An update, driver repair, or verification prompt appearing immediately after joining public Wi-Fi
• A request to install software or sideload an APK just to restore internet access
• A portal page that looks different from the venue's normal branding
• Being asked to enter a device code you did not request into a Microsoft sign-in page

Building Resistance

Treat any install prompt from a public Wi-Fi portal as untrusted, since legitimate networks rarely require software installs to grant access. Never complete a device code sign-in unless you personally initiated it, and report unexpected code prompts right away. Favoring personal hotspots or satellite connections over shared hotel and conference networks reduces exposure. Organizations can further reduce risk by disabling device code authentication where feasible, removing this particular path for attackers to seize workplace cloud access.

How does the hotel Wi-Fi attack actually work?

Attackers compromise public Wi-Fi captive portals and manipulate DNS/HTTP traffic to redirect users to attacker-controlled pages that show fake update or verification prompts, tricking victims into installing malware or completing a device code sign-in.

What malware is delivered in this campaign?

Microsoft identified CornFlake, a persistent remote access trojan, and ChocoShell, an in-memory infostealer that targets cookies, passwords, SSO tokens, and Wi-Fi credentials.

What is device code phishing and why is it dangerous here?

Victims are told to enter a code the attacker generated into a legitimate Microsoft sign-in page, which unwittingly authorizes the attacker's session and hands over a valid OAuth token for the victim's Microsoft 365 account.

What can organizations do to reduce this risk?

Microsoft recommends reducing trust in public Wi-Fi, favoring personal hotspots or satellite connections over hotel networks, and disabling device code authentication where feasible.