What does CornFlake malware do?

CornFlake is a Go-based remote access trojan (RAT) deployed by APT29 in the CaptiveCrunch campaign. Its documented capabilities include: remote shell access, keylogging, clipboard monitoring, screenshot capturing, microphone and webcam surveillance, browser credential and cookie theft, Microsoft 365 session token theft, file exfiltration, USB monitoring, and system reconnaissance. When executed, it shows a fake progress window (mimicking Windows Update, Defender scans, or browser updates) to distract the victim while copying itself to AppData for persistence.

How does this attack relate to PCI-DSS v4.0.1 requirements?

Hotels are PCI-DSS merchants because they process payment card transactions. PCI-DSS v4.0.1 requires network segmentation between cardholder data environments and other networks (Requirement 1.3), network traffic monitoring and anomaly detection (Requirement 11.4), critical security control failure detection and reporting (Requirement 10.7), and annual penetration testing (Requirement 11.3). The CaptiveCrunch attack succeeds because DNS manipulation on captive portal hardware is rarely included in network monitoring scope, and the attack does not directly target the payment network, it targets the guest Wi-Fi network used by employees. PCI-DSS does not require monitoring of the guest network in the same way as the cardholder data environment, creating a blind spot.

What Microsoft 365 controls protect against hotel Wi-Fi attacks?

The primary controls are Conditional Access policies in Microsoft Entra ID. Specifically: requiring compliant device status before granting access (device compliance policy), enabling sign-in risk detection with high-risk blocking or MFA step-up, configuring impossible travel detection to flag logins from unusual locations, restricting OAuth code flow authentication used in the phishing variant, enabling session risk policies that revoke tokens when anomalous activity is detected, and requiring hardware-bound MFA (FIDO2/passkeys) rather than authenticator app codes. For traveling employees, a split-tunnel VPN that routes Microsoft 365 traffic through corporate infrastructure adds another layer of protection against DNS manipulation.

What should CISOs do to protect employees who travel?

The most effective controls are: review and tighten Conditional Access policies for scenarios where users authenticate from untrusted networks, configure session token lifetime limits so stolen tokens have short validity windows, enable continuous access evaluation so compromised tokens are revoked faster, require hardware-bound authentication for high-privilege accounts, train employees to be suspicious of unexpected authentication prompts on hotel networks, and consider a mobile hotspot policy for executives and high-risk roles so they avoid hotel Wi-Fi entirely. For PCI-DSS compliance, review whether hotel properties in your estate have their guest Wi-Fi DNS monitoring in scope, even though it is technically outside the cardholder data environment.

Your Hotel Is PCI-DSS Certified. APT29 Targeted It Anyway.

Q: What is the CaptiveCrunch APT29 hotel Wi-Fi attack?

CaptiveCrunch is a global campaign attributed by Microsoft to Midnight Blizzard (APT29, Storm-2945), active since at least early May 2026, with Microsoft publishing attribution on July 31, 2026. The attackers compromise captive portal hardware at hotels and conference centers, then modify DNS and HTTP traffic settings. This allows them to redirect guests connecting to hotel Wi-Fi to phishing pages impersonating Microsoft 365 login portals, or to ClickFix prompts that deliver custom malware called CornFlake and ChocoShell. The campaign targets business travelers and conference attendees to steal corporate Microsoft 365 credentials and session tokens.

Executive Answer

On July 31, 2026, Microsoft confirmed that Midnight Blizzard (APT29) has been running a global campaign against hotel and conference center Wi-Fi networks since at least May. The campaign, named CaptiveCrunch, manipulates DNS on captive portal hardware to redirect guests to fake Microsoft 365 login pages or malware delivery pages. Stolen credentials and session tokens give attackers persistent access to corporate Microsoft 365 environments. Hotels are PCI-DSS environments. Their networks are supposed to be segmented and monitored. The problem is that PCI-DSS monitoring requirements focus on cardholder data environments, not guest Wi-Fi infrastructure. Most hotel networks have a compliance gap here. And business travelers connecting from hotel Wi-Fi bring this threat directly into their corporate cloud tenants.

Key Numbers

May 2026 - Earliest confirmed CaptiveCrunch activity, based on Microsoft's analysis. The campaign was running for months before public disclosure.
July 31, 2026 - Date Microsoft published attribution linking CaptiveCrunch to APT29 (Storm-2945), a sub-cluster of Midnight Blizzard.
2 malware families - CornFlake (Go-based RAT with keylogging, credential theft, M365 session token extraction) and ChocoShell (secondary payload for persistence and data exfiltration).
3 attack vectors - Fake M365 login pages, OAuth device code phishing abusing Microsoft Entra ID, and ClickFix prompts delivering malware via fake browser update pages.
March 31, 2025 - Deadline when all PCI-DSS v4.0.1 future-dated requirements became mandatory. Network monitoring requirements (Req 11.4) and critical control failure detection (Req 10.7) were among those required by this date.

Your hotel probably has a PCI-DSS certificate. APT29 attacked it anyway. And the attack worked not because PCI-DSS failed, but because the guest Wi-Fi network was outside its scope.

On July 31, 2026, Microsoft published attribution for a campaign they named CaptiveCrunch. The threat actor is Storm-2945, a sub-cluster of Midnight Blizzard, the Russian intelligence-linked group also known as APT29 and Cozy Bear. The campaign has been active since at least May 2026. Its target: business travelers connecting to hotel and conference center Wi-Fi networks.

The attack does not start with a zero-day. It starts with a DNS change.

The attackers compromise captive portal hardware, the equipment that runs hotel Wi-Fi check-in pages. Once they control the captive portal, they modify DNS and HTTP traffic routing. Every device connecting to the hotel network is now subject to what the attacker wants them to see. That might be a convincing fake Microsoft 365 login page. Or a device code phishing flow that abuses Microsoft Entra ID authentication. Or a ClickFix prompt with a fake browser update that delivers CornFlake, APT29's custom Go-based remote access trojan.

What CornFlake Actually Does

CornFlake is not a simple credential harvester. Microsoft's analysis shows it as a full-featured implant with capabilities that cover the entire post-compromise lifecycle: remote shell, keylogging, clipboard monitoring, screenshot capture, webcam and microphone access, browser credential theft, Microsoft 365 session token extraction, file exfiltration, and USB device monitoring.

When it executes, it shows a fake progress window designed to look like a legitimate system process: a Windows update, a Defender scan, a browser update. The victim sees something plausible and waits. In the background, CornFlake copies itself to AppData, establishes persistence, and begins its work.

The session tokens it steals give the attacker authenticated access to Microsoft 365 without needing the user's password or MFA code. Depending on how token lifetime and Conditional Access policies are configured, those tokens may remain valid for hours or days after the employee has checked out of the hotel and boarded a flight home.

The PCI-DSS Gap This Exposes

Hotels are PCI-DSS merchants. They process payment card transactions through property management systems, point-of-sale terminals, and online booking platforms. PCI-DSS v4.0.1 requires network segmentation between cardholder data environments and other network segments, network traffic monitoring, anomaly detection, and annual penetration testing.

Here is where the gap lives. PCI-DSS requirements focus on the cardholder data environment: the systems that store, process, or transmit payment card data. Guest Wi-Fi is typically a separate segment, connected to the internet but not directly to payment systems. From a PCI-DSS perspective, the guest network is often out of scope.

But the employees connecting to that guest network are not out of scope. They are using hotel Wi-Fi to access corporate Microsoft 365 tenants, internal VPNs, and cloud applications. When APT29 redirects their traffic and steals their M365 session tokens, the hotel's PCI-DSS certificate is irrelevant. The corporate tenant is now compromised through a vector the compliance program never evaluated.

PCI-DSS v4.0.1 Requirement 11.4 requires network intrusion detection. Requirement 10.7 requires detecting and reporting critical security control failures. These requirements apply to the cardholder data environment. They do not require the hotel to monitor DNS manipulation on the guest Wi-Fi captive portal, because that network is out of scope.

The compliance program passed. The attack worked. Both things are true at the same time.

Microsoft Entra ID Is the Real Defense Layer

The attacker cannot steal what is not there to steal. The primary defense is not at the hotel network layer. It is in how Microsoft 365 and Entra ID are configured to respond when users authenticate from untrusted networks.

Conditional Access policies that require device compliance before granting access are effective here because a compromised hotel device or a phishing-collected credential will not satisfy the compliance check. Sign-in risk policies that require additional verification for logins from new locations or anonymous IP addresses add friction at the moment of attack. Session token lifetime limits reduce how long a stolen token remains usable. Continuous access evaluation pushes revocation to the token level rather than waiting for the session to expire naturally.

For the OAuth device code phishing variant, restricting which applications and flows are permitted to use device code authentication removes the attack surface entirely. Microsoft's documentation on Conditional Access covers this specifically.

For employees who regularly travel to high-risk destinations or attend international conferences, the simplest mitigation is a company-issued mobile hotspot. It eliminates the hotel network entirely as a threat vector.

What CISOs Should Do Now

Review your Conditional Access policies for travel scenarios. Ask specifically: what happens when an employee authenticates from a hotel in London, Singapore, or Dubai? Does your policy require device compliance? Does it apply risk-based MFA step-up? Does it limit session token lifetime? If the answer to any of these is "we're not sure," that is the starting point.

Audit your OAuth device code flow permissions. The CaptiveCrunch device code phishing variant abuses Microsoft Entra ID flows that most organizations leave open by default. Conditional Access can restrict which client apps and authentication flows are permitted. Review and restrict this if you have not already.

Configure continuous access evaluation. This is one of the most underused Entra ID features. It allows Microsoft 365 services to receive near-real-time signals about token revocation rather than honoring tokens until their expiry. When anomalous activity is detected, access is revoked at the token level within minutes rather than hours.

Brief your travel-heavy employees on hotel network risk. This is not about user error. It is about establishing a clear policy: company-issued hotspot for any work that requires Microsoft 365 access on the road, and immediate incident reporting if any unexpected authentication prompt appears on a hotel Wi-Fi network.

If you manage hotels or conference facilities, revisit your PCI-DSS scope definition. The guest Wi-Fi network may be formally out of scope for PCI-DSS. That does not mean it is out of scope for your security program. A compromised captive portal on the guest network has direct paths to corporate devices and cloud tenants. Include it in your threat model even if it is not in your compliance scope.

Asaf's Take

CaptiveCrunch is a reminder that compliance scope and threat scope are not the same thing. Hotels are PCI-DSS certified, and the certification is for the right things: protecting cardholder data. But it says nothing about what happens on the guest network when one of your employees connects from the hotel lobby. APT29 has been running this campaign since May. By the time Microsoft published attribution on July 31, the credentials and session tokens were already gone. The defense is not at the hotel. It is in how you have configured Microsoft 365 and Entra ID to behave when your employees are not behind your perimeter. Most organizations have not looked at this carefully enough.

What is the CaptiveCrunch APT29 hotel Wi-Fi attack?

CaptiveCrunch is a global campaign attributed to Midnight Blizzard (APT29). The attackers compromise captive portal hardware at hotels and conferences, modify DNS settings, and redirect guests to fake Microsoft 365 login pages or malware delivery pages. The campaign has been active since at least May 2026 and was publicly attributed by Microsoft on July 31, 2026.

Why does PCI-DSS certification not prevent this attack?

PCI-DSS requirements focus on cardholder data environments. Guest Wi-Fi is typically a separate network segment outside the formal PCI-DSS scope. The attack targets employees connecting from that guest network to corporate cloud services, a vector that PCI-DSS compliance programs do not address.

What Microsoft 365 controls protect against this attack?

Conditional Access policies requiring device compliance, sign-in risk detection, OAuth device code flow restrictions, session token lifetime limits, and continuous access evaluation are the primary controls. A mobile hotspot policy eliminates the hotel network entirely as an attack vector for high-risk roles.