Our takeMicrosoft ties hijacked hotel Wi-Fi pushing fake browser updates that deliver the CornFlake RAT to Midnight Blizzard. The malware records webcams, audio, and keystrokes to raid Microsoft 365 accounts. On public Wi-Fi use a VPN and ignore unexpected update prompts.Cyber Resilience desk
Sources (2)
- hackernews · hackernews
- bleeping · bleeping
What this means for you — Security leader:Traveling staff should treat hotel Wi-Fi as hostile: use a VPN at all times, avoid captive-portal browser updates, and require phishing-resistant MFA for M365 access.
What this means for you — Lean IT orgs:If your team travels, always run a VPN on hotel or public Wi-Fi and never install browser updates pushed by the network.
What this means for you — MSP:Advise clients whose staff travel to block captive-portal browser updates, enforce always-on VPN on untrusted networks, and monitor M365 sign-ins for anomalous device-code or token activity.
What this means for you — Researcher:Track CaptiveCrunch/Storm-2945 TTPs; the custom CornFlake RAT and hotel Wi-Fi hijacking expand known Midnight Blizzard (APT29) tradecraft.