Microsoft Threat Intelligence has detailed a new campaign dubbed CaptiveCrunch, in which a Russian SVR-linked cluster called Storm-2945 — an operational sub-group of APT29 (Cozy Bear) — is compromising hotel and conference centre Wi-Fi gateways to silently steal Microsoft 365 and Azure Active Directory access tokens from business travellers. The attacks have been confirmed across several US cities, India, and Saudi Arabia, targeting professionals in finance, legal, healthcare, energy, and professional services.
How It Works
Unlike traditional spear-phishing campaigns, CaptiveCrunch requires no malicious email and no direct contact with the victim's device. Attackers gain administrative control over hotel Wi-Fi captive portal gateways by exploiting internet-facing management interfaces protected only by weak or default credentials. From that privileged network position, they manipulate DNS and HTTP traffic for every guest who connects.
Victims are silently redirected to spoofed Microsoft login pages. Two custom malware tools carry the payload:
- CornFlake — delivered as a fake software update prompt pushed over the compromised Wi-Fi connection. It harvests cloud authentication tokens directly from the victim's session.
- ChocoShell — an in-memory PowerShell stealer. It targets Microsoft 365 and Azure AD access tokens, refresh tokens, and Web Account Manager (WAM) tokens stored in
.tbresfiles inside the Windows Token Broker cache. These tokens enable session replay attacks, allowing the attacker to impersonate the victim without needing browser cookies or passwords.
MFA Is Not Enough
In a subset of confirmed cases, Storm-2945 abused Microsoft's device-code authentication flow. Victims who approved what appeared to be a standard MFA prompt inadvertently granted the attacker a fully valid access token. Completing MFA did not protect them — the authentication success itself was the attack delivery.
This is a significant escalation: the attackers do not need to break MFA, they weaponise it.
Why This Campaign Is Noteworthy
Traditional "evil twin" Wi-Fi attacks require the attacker to be physically co-located with the victim and operate their own rogue access point. CaptiveCrunch is different — attackers seize control of the legitimate hotel infrastructure, affecting every guest simultaneously, from any location once the gateway is compromised.
Microsoft notes that forcing public DNS resolvers such as Google's 8.8.8.8 does not mitigate this attack; the gateway reads and tampers with DNS queries before they leave the network. Microsoft also disclosed it collaborated with Anthropic and OpenAI during the investigation, noting that Storm-2945 used AI to support aspects of the campaign.
Targeted Sectors
Confirmed victims span finance, law, healthcare, energy, retail, and professional services — any employee who travels and connects to hotel Wi-Fi without a full-tunnel corporate VPN is a potential target.
Recommended Mitigations
- Deploy always-on, full-tunnel corporate VPNs that activate before any network traffic leaves the device.
- Disable Entra ID device-code authentication flows where not operationally required.
- Review Azure AD and Microsoft 365 sign-in logs for logins originating from unexpected countries or IP address ranges.
- Treat captive portal login pages that request Microsoft credentials with extreme suspicion — legitimate hotel portals do not require corporate SSO.
- Audit Token Broker cache files (
.tbres) on devices that have recently travelled.
CaptiveCrunch is a reminder that network-layer compromise can be more powerful than endpoint compromise: when an attacker controls the road, they see every vehicle on it.