Hotel Wi‑Fi Hijack Serves Fake Updates to Deploy CornFlake RAT
Microsoft disclosed that attackers hijacked hotel captive‑portal Wi‑Fi to push counterfeit browser updates that install the CornFlake remote‑access trojan. The Go‑based RAT, linked to the Storm‑2 sub‑group of Russia’s SVR‑backed APT29, can spy via webcam, microphone, keystrokes and steal credentials. Travelers should use trusted VPNs and reject unsolicited updates.