Hotel Wi-Fi attacks breach Microsoft 365 accounts

Microsoft linked the CaptiveCrunch campaign to Storm-2945, a Midnight Blizzard sub-cluster, targeting hotel Wi-Fi to steal Microsoft 365 accounts. The attackers manipulate DNS to redirect users to phishing pages and deliver CornFlake and ChocoShell malware, active since at least early May.