Microsoft reports a new operation, CaptiveCrunch (attributed to Storm-2945, a sub-cluster of Midnight Blizzard), using hijacked hotel Wi-Fi to deliver surveillance malware. The attack vector involves serving fake browser updates that install CornFlake, a remote access trojan (RAT). CornFlake is capable of capturing webcam images, microphone audio, and keystrokes, highlighting the dangers of untrusted networks and the sophistication of state-sponsored threat actors.