Hijacked Hotel Wi-Fi Pushes Fake Updates to Deliver Surveillance Malware

A hijacked hotel Wi-Fi network has been used to deliver malware by serving fake browser updates. The malware, known as CornFlake, is a remote access trojan that can capture images from webcams, audio from microphones, and keystrokes. This operation is tracked as CaptiveCrunch and is attributed to Storm-2945, which is believed to be a sub-cluster of Midnight Blizzard. Microsoft has reported on this operation in its latest report, detailing the tactics used to deliver the CornFlake malware. The malware allows for significant surveillance capabilities, making it a notable threat. The attribution to Storm-2945 provides insight into the group's activities and tactics.