Russian Hackers Hijack Hotel Wi-Fi Networks to Spread Malware

A new report from Microsoft reveals that Russian state-sponsored hackers, known as Midnight Blizzard (APT29), have been hijacking hotel Wi-Fi networks to spread malware. The attackers are targeting captive portal equipment, which manages login pages for public Wi-Fi users.

When a user connects to a compromised network, they may be redirected to a fake Microsoft 365 login page that steals their credentials or prompted to download malicious software that can steal files, credentials, and device data. The malware variants being distributed include CornFlake and CocoShell.

CornFlake is an infostealer that can grab keystrokes, clipboard contents, and other sensitive information, while CocoShell targets browser cookies, saved passwords, Microsoft 365 tokens, and Wi-Fi credentials. APT29 has been linked to Russia's Foreign Intelligence Service and has carried out notable attacks on high-ranking western targets.