Technology ❯ Cybersecurity ❯ Threat Actors ❯ State-Sponsored Attacks
Microsoft says the operation compromises captive-portal systems to serve fake sign‑in or update pages that harvest tokens or install CornFlake and ChocoShell.