Hijacked Hotel Wi-Fi Pushes Fake Updates to Deliver Surveillance Malware

A fake browser update served over hijacked hotel Wi-Fi has been used to deliver CornFlake, a remote access trojan (RAT) that can capture webcam images, microphone audio, and keystrokes, Microsoft said in its latest report. Researchers track the operation as CaptiveCrunch and attribute it to Storm-2945. It assesses Storm-2945 to be an operational sub-cluster of Midnight Blizzard, also known as

According to Microsoft, attackers hijacked hotel Wi-Fi captive portals to deliver a fake browser update that installs CornFlake, a remote access trojan capable of capturing webcam images, microphone audio, and keystrokes, in an operation tracked as CaptiveCrunch and attributed to Storm-2945 under the Midnight Blizzard umbrella.[1][9][10] This reflects a targeted cyberespionage pattern similar to prior DarkHotel-style campaigns, where hotel Wi-Fi is abused to push spoofed software updates and deploy keyloggers and credential-stealing malware against traveling executives.[7][8][11][14] From a RealGround perspective, while the campaign itself does not appear to use AI as a core component, it exemplifies sophisticated, persistent adversary tradecraft that AI agents may later be asked to analyze, triage, or respond to; organizations need continuous red teaming of their AI-assisted detection, travel security workflows, and incident-response playbooks so that AI systems neither trust compromised network content nor assist in exfiltrating sensitive data. Practically, enterprises should enforce always-on VPN for corporate devices, block risky update flows on untrusted networks, and regularl