Hotel Wi-Fi Hijack Delivers Surveillance Trojan

A recent incident showed that an attacker compromised the Wi‑Fi system at a hotel chain, using the network’s captive portal to deliver a counterfeit browser update. When guests connected, the bogus update was automatically downloaded and executed on their devices. The payload, known as CornFlake, is a remote‑access trojan capable of capturing webcam images, microphone audio, and keystrokes in real time. Microsoft said this activity in its latest report.¹

Researchers identified the operation under the code name CaptiveCrunch and attribute it to Storm-2945, a sub-cluster within Midnight Blizzard—also referred to by other analysts as Midnight Blizzard. This connection suggests possible nation-state involvement, given Midnight Blizzard’s history of targeting U.S. critical infrastructure and defense contractors since late 2023. The use of a captive portal mirrors tactics employed by groups specializing in hotel and airport networks; similar delivery methods were documented for rogue portals over the past two years.¹

By disguising malicious code as a routine browser patch, attackers allowed it to evade common security checks. Once installed, CornFlake could capture sensitive data without user interaction. From an operational standpoint, the choice of a hotel Wi‑Fi network is strategic: guests often connect with personal devices that have minimal pre-configured security settings, making them prime targets for such attacks.

Experts note that similar malware payloads distributed via rogue captive portals have been documented at least six times over the past two years. While specific numbers of affected guests remain undisclosed, the potential reach across multiple rooms and devices amplifies risk. Analysts suggest that while CornFlake’s capabilities are formidable, its reliance on a compromised Wi‑Fi infrastructure limits scalability compared to more widespread phishing campaigns. Nonetheless, the attack demonstrates how attackers can combine supply-chain manipulation (via counterfeit browser updates) with sophisticated malware to breach privacy at scale within hospitality environments.

Continued vigilance in securing captive portals and validating software authenticity will be key defenses against similar future threats.