Updated

Updated · BleepingComputer · Aug 4

Microsoft Links 2 New Malware Strains to Russian Wi-Fi Attacks on Microsoft 365 Users

Updated

Updated · BleepingComputer · Aug 4

Microsoft Links 2 New Malware Strains to Russian Wi-Fi Attacks on Microsoft 365 Users

Q: If changing your DNS settings cannot protect you from rogue hotel networks, what is the only true way to secure your data abroad?

The strongest practical protection abroad is to avoid untrusted venue Wi‑Fi entirely and use your own cellular hotspot; if you must use public Wi‑Fi, the key control is an always-on, full-tunnel VPN. That is because this attack sits at the network gateway, not on your device. ReliaQuest found attackers changing DNS on hotel and conference Wi‑Fi equipment so users are silently redirected to fake Microsoft 365 pages. Researchers warned that simply switching to Google or other public DNS does not stop it, because a compromised gateway can forge DNS replies before your request reaches that resolver. A personal hotspot is the cleanest answer for travelers because it removes the hotel or conference network from the trust chain. You are no longer relying on a captive portal or shared gateway that may have been tampered with. Security specialists increasingly advise business travelers to treat all public hospitality Wi‑Fi as potentially hostile for sensitive logins. For corporate devices, experts say the most effective technical defense is enforcing an always-on, full-tunnel VPN. Full-tunnel VPN sends all traffic, including DNS, through trusted corporate infrastructure before the local Wi‑Fi can manipulate it. Split tunneling weakens that protection. Even then, travelers should still verify URLs carefully and reject unexpected device-code prompts, because attackers are also abusing Microsoft’s device-code flow to steal valid tokens that can sometimes bypass traditional MFA.

3 articles · Updated · BleepingComputer · Aug 4

Microsoft said the CaptiveCrunch campaign has targeted hospitality Wi-Fi worldwide since at least May, tying it to Russian state-linked Storm-2945, a Midnight Blizzard sub-cluster.
DNS and HTTP tampering on hotel and conference captive portals lets attackers redirect users to fake Microsoft 365 logins, device-code phishing pages, or bogus update screens that deliver malware.
CornFlake and ChocoShell give the operators persistent access and broad theft capabilities, including browser credentials, Microsoft 365 and Azure AD tokens, Wi-Fi passwords, screenshots, keystrokes, and file exfiltration.
Microsoft also found signs of Android APK delivery, an exposed FruitStone control panel for managing infected systems, and code comments suggesting AI tools likely helped build the malware.
The company urged travelers and security teams to treat hospitality Wi-Fi as untrusted, prefer cellular or managed connections, and use phishing-resistant MFA or passkeys while disabling unused Entra device-code authentication.