Hijacked Hotel Wi-Fi Pushes Fake Updates to Deliver Surveillance Malware

A sophisticated threat actor, tracked as Storm-2945 and linked to Russia's SVR, has been hijacking hotel Wi-Fi networks to distribute malware. The attackers redirect users to fake update pages, tricking them into downloading a remote access trojan called CornFlake, which can steal sensitive data and provide surveillance capabilities. The operation, dubbed CaptiveCrunch, also leverages stolen authentication tokens to gain further access.