Russia's SVR turned hotel Wi-Fi into an MFA bypass

Russia's foreign intelligence service, the SVR, is turning hotel, airport, and café Wi-Fi into a malware delivery system. The campaign, which Microsoft calls CaptiveCrunch and has been observed since early May, hijacks the captive-portal gateways travelers see when they connect to a public network. The Register and The Hacker News confirmed the broad shape of the operation in the days that followed. Once the gateway is under attacker control, the Wi-Fi itself becomes the lure.

They are using a legitimate Microsoft login flow, the device-code authentication flow built into Entra ID, that is designed for input-constrained devices like smart TVs and shell scripts. Microsoft has documented that the flow has been integrated with captive-portal traffic manipulation since at least July 16, and that it works on fully patched, fully MFA-protected accounts. The captive portal is the delivery truck. The device-code flow is the actual breach.

CaptiveCrunch sits inside Storm-2945, which Microsoft assesses as an operational sub-cluster of Midnight Blizzard. The US and UK governments attribute Midnight Blizzard to the SVR, also tracked as APT29 or Cozy Bear, the same service blamed for the 2020 SolarWinds operation. The same SVR has a documented history of cloud-focused tradecraft, which CISA advisory aa24-057a covers, but that earlier advisory does not cover the CaptiveCrunch captive-portal campaign. Microsoft describes the broader Storm-2945 operations as AI-augmented, a Microsoft-observed assessment rather than independently corroborated tradecraft detail.

ReliaQuest has independently documented the same captive-portal campaign but reaches a different attribution. The private threat intelligence firm assesses the same techniques overlap with APT28, also known as Fancy Bear or Forest Blizzard, the GRU's military intelligence unit, at low-to-medium confidence. The overlap comes from the April 2026 FrostArmada SOHO-router DNS-hijack operation. The captive-portal shift and new infrastructure mean this is not direct technical linkage, and the two vendors have not reconciled their reads. Either way, the tradecraft is now in the field.

ReliaQuest observed compromise of hospitality captive-portal gateways across multiple US cities, India, and Saudi Arabia, with victim industries spanning financial services, professional services, legal, health care, energy, and retail. Microsoft separately noted commonalities in equipment and management systems across affected networks, hinting at shared-services access rather than isolated venue compromises. Neither vendor has named a property, vendor, or management provider. The campaign is widespread but targeted, and the public reporting does not quantify how many devices have been compromised, how many device-code approvals succeeded, or how many accounts have been stolen.

The delivery chain has two parts. First, the captive portal redirects the traveler's browser to a fake update prompt, a ClickFix-style page that asks the user to run a command or install a "browser helper." That drops one of two implants. CornFlake is a Go-based Windows remote-access tool that logs keystrokes, captures screenshots, records audio and video, reads Chrome credentials past the App-Bound Encryption protection, exfiltrates files, watches USB drives, and opens a remote shell. ChocoShell is an in-memory PowerShell infostealer that targets browser session cookies, saved passwords, Microsoft 365 single-sign-on tokens, and Wi-Fi passwords, then beacons to a hardcoded command server at 213.145.86[.]112. Both implants can persist through a service install and redundant registry and scheduled-task entries, with a watchdog that relaunches the implant if it is killed.

Microsoft has documented the doppelganger infrastructure behind the device-code leg: four look-alike Microsoft 365 login pages at m365-owa[.]com, owa-ms365[.]com, ms365-device[.]com, and ms365-live[.]com, hosted at 31.57.243[.]154 and 104.194.159[.]150. The fake portals present a real Microsoft device-code prompt. The traveler approves the code on their own device, expecting it to authorize a TV or printer. It actually grants the attacker a token against the victim's account, and the token is not subject to MFA.

The mitigation is not a patch. Device-code authentication is a legitimate OAuth flow that exists by design. Closing the gap for an organization is a Conditional Access policy that disables the device-code flow for users who don't need it, paired with always-on full-tunnel VPN on corporate devices and encrypted DNS in strict mode (DNS-over-HTTPS or DNS-over-TLS, with plaintext fallback disabled) on the network. Microsoft and ReliaQuest both recommend the same set of controls.

Travelers who don't administer Entra get a smaller version of the same playbook. Use a phone hotspot for anything sensitive rather than hotel or conference Wi-Fi. If you must connect, run a reputable VPN before opening the browser. Keep the operating system and browser patched, watch for unexpected captive-portal redirects or certificate warnings, and run a separate browser profile, or better, a separate device, for travel, so a stolen session token doesn't hand over the primary work account. The SVR's new move is technically clever, but the delivery surface is still public Wi-Fi. Treating it as untrusted is the change that closes most of the gap.