Russian SVR Wi-Fi Attack Delivers CornFlake Malware

Microsoft attributed the CaptiveCrunch campaign to Storm-2945, an SVR sub-cluster of Midnight Blizzard, targeting hospitality Wi-Fi captive portals. The attack delivers CornFlake, a Go-based RAT, and ChocoShell, an in-memory PowerShell infostealer, via ClickFix prompts and device code phishing to steal Microsoft 365 tokens.