Hijacked Hotel Wi-Fi Pushes Fake Browser Updates to Deploy Surveillance Malware
Attackers exploit unsecured hotel networks to deliver a remote access trojan via fake update prompts — a lesson in supply-chain and network trust.
Microsoft has reported a campaign, tracked as CaptiveCrunch and attributed to the Storm-2945 sub-cluster of Midnight Blizzard, in which attackers hijacked hotel Wi-Fi networks to serve fake browser updates. The malicious updates deliver CornFlake, a remote access trojan (RAT) capable of capturing webcam images, microphone audio, and keystrokes. The attack chain begins when a guest connects to the compromised hotel Wi-Fi; the attacker intercepts the connection and redirects the user to a page mimicking a legitimate browser update prompt. If the user downloads and runs the fake update, CornFlake is installed, giving the attacker persistent access to the device.
Why it matters
This incident highlights how attackers are moving beyond email phishing to exploit trusted physical environments — hotels, airports, conference centers — where users expect connectivity to be safe. It also shows that state-linked groups are investing in operational security by using sub-clusters to obscure attribution. For learners, it underscores that trust in a network does not equal trust in the traffic flowing through it.
Guest connects to hotel Wi-Fi
Attacker-controlled access point or ARP spoofing intercepts traffic.
Fake browser update prompt
User is redirected to a page mimicking a legitimate update.
User downloads and runs the file
The file is CornFlake RAT disguised as an update.
RAT establishes persistence
What you can learn from this
- Network segmentation and guest isolation: In a hotel or public Wi-Fi, guests should be isolated from each other and from the management network. Attackers hijack the connection because the network lacks proper segmentation. As a learner, practice designing a simple network topology with a separate VLAN for guest traffic and strict firewall rules preventing guest-to-guest communication.
- HTTPS and certificate validation: The attack works because the user accepts a fake update page served over HTTP or a spoofed HTTPS certificate. Always check for the padlock icon and verify that the certificate matches the domain. In your own projects, enforce HTTPS-only connections and implement certificate pinning where possible.
- Supply-chain trust and software update hygiene: Legitimate software updates are delivered through official channels (e.g., the app store or the vendor's own update mechanism). Never download updates from a pop-up or a third-party site. As a practice, configure automatic updates from trusted sources and educate users to ignore unsolicited update prompts.
- Endpoint detection and response (EDR): CornFlake is a RAT that evades simple antivirus by behaving like legitimate software. EDR tools monitor process behavior, network connections, and file system changes to detect anomalies. If you are learning security, set up a free EDR tool (like Wazuh) on a lab machine and observe what normal vs. malicious activity looks like.
- Least privilege and user awareness: The RAT captures keystrokes and camera data because the user runs it with full permissions. On any device, run software with the minimum privileges needed. For learners, practice creating a standard user account for daily work and only use an admin account for installations.
We teach this
Sources
- Hijacked Hotel Wi-Fi Pushes Fake Updates to Deliver Surveillance Malware — The Hacker News
Our reporting is an original summary; full coverage is at the links above.
Don't just read about it — build it.
Square 1 teaches the skills behind the headlines, with every line of your work graded by AI. Find your starting point in 3 minutes.
Get your free skill report