Microsoft Threat Intelligence reports that a Midnight Blizzard sub-cluster, tracked as Storm-2945, is using compromised captive-portal Wi-Fi environments to target travelers with phishing and malware delivery. The campaign, which Microsoft calls CaptiveCrunch, matters because it moves initial access into a place many organizations still treat as low risk: hotel, conference, and shared-venue networks used by employees on the road.

According to Microsoft, activity has been observed since early May 2026 against hospitality-related networks and other captive-portal environments in multiple countries. The actor manipulates DNS and HTTP traffic to redirect users through attacker-controlled infrastructure, including doppelganger Microsoft-themed pages and fake browser or operating-system update flows. Microsoft also links the activity to device-code and OAuth phishing that can lead to Microsoft Entra device registration and Microsoft 365 data collection.

Why this is different from normal travel Wi-Fi risk

The usual advice around hotel Wi-Fi is “use a VPN and avoid sensitive work.” CaptiveCrunch shows why that is no longer enough. This is not just passive snooping on an open network. Microsoft describes active traffic manipulation from networks served by captive portals, with malware delivery triggered during normal connectivity checks and sign-in flows. That means a traveler may be redirected before they ever reach the cloud service they intended to use.

The reported toolchain is also built for enterprise impact. Microsoft describes Windows malware variants including CornFlake, a Go-based remote access trojan with persistence, encrypted command-and-control, host reconnaissance, file theft, keylogging, clipboard capture, screenshot capture, browser credential theft, session-token collection, and remote-shell capability. Microsoft also describes ChocoShell, an in-memory PowerShell infostealer focused on browser cookies, saved passwords, Microsoft 365 SSO tokens, Web Account Manager tokens, and Wi-Fi credentials.

What SMBs and government contractors should do first

  • Treat travel endpoints as exposed assets. Require full EDR coverage, disk encryption, fast patching, and tamper protection on laptops used for conferences, hotels, client sites, and airports.
  • Harden Microsoft Entra authentication. Review device-code flow controls, OAuth app consent settings, risky sign-in policies, conditional access, and device compliance requirements.
  • Watch for token theft, not just password theft. Session cookies, refresh tokens, and WAM tokens can bypass the mental model of “MFA stopped the login.” Monitor impossible travel, unusual Graph activity, abnormal device registration, and mail access from unfamiliar infrastructure.
  • Reduce local admin on travel laptops. Microsoft describes malware capabilities that become more damaging when the user is a local administrator, including credential extraction and privilege-elevation paths.
  • Use managed secure access for travel. Prefer always-on VPN/ZTNA with DNS protection, secure web gateway controls, browser isolation for high-risk activity, and protective DNS that continues to operate off-network.
  • Build a travel incident playbook. If an employee reports a suspicious captive portal, fake update, or unusual Microsoft sign-in prompt while traveling, assume possible token compromise and rotate sessions quickly.

Bulwark Black assessment

CaptiveCrunch is a strong reminder that identity compromise does not always start with an email. For defense industrial base companies, small contractors, legal teams, consultants, and executives who travel with privileged access, the hotel network can become the first hop into Microsoft 365, source code, deal documents, or customer data.

The practical move is to stop treating “remote work security” as only a home-office problem. Travel networks should be considered hostile by default. Enforce conditional access, keep endpoint telemetry alive off-network, restrict device-code and OAuth abuse paths, and make session-token theft part of detection and response planning.

Original source: Microsoft Threat Intelligence — CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft