What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Microsoft says a Windows infostealer called ChocoShell can collect saved browser passwords, session cookies, Microsoft 365 sign-in tokens and Wi-Fi credentials. Its July 31, 2026 report does not say ChocoShell steals payment-card data, so the headline’s card claim is not supported by this report.
ChocoShell is one part of a broader malware operation Microsoft describes as targeting travelers and networks that use captive portals. The practical warning is simple: do not run commands or install updates prompted by an unexpected hotel, airport or other guest Wi-Fi page.
What can ChocoShell steal?
Microsoft Threat Intelligence reports that ChocoShell, a PowerShell infostealer for Windows, can collect several kinds of credentials and session data from a compromised computer:
- Saved browser passwords and other Chromium browser data.
- Browser cookies, including cookies from Firefox-family browsers. Stolen session cookies may let an attacker access an account without entering its password again, depending on the service and whether the session remains valid.
- Microsoft 365 and Azure AD tokens, including access and refresh tokens, as well as Web Account Manager tokens.
- Saved Wi-Fi credentials from the infected Windows system.
The report’s ChocoShell collection list does not include payment-card data. That does not establish that no malware steals cards; it means this specific Microsoft report does not support attributing card theft to ChocoShell. Microsoft’s CaptiveCrunch report is the source for the capabilities listed here.
#1 Best Overall
- Spacious Design: Measuring 21.1" wide and 14.1" deep, our lap desk comfortably fits most laptops up to 15.6". Extra room for accessories ensures convenience.
- Enhanced Functionality: Packed with handy features, including a 5x9" precision tracking mouse pad and a built-in phone slot for seamless work or video calls. Plus, enjoy ergonomic support with the integrated cushioned wrist rest.
- Cool Comfort: Enjoy a stable surface with our lap desk's dual bolster cushion, designed for comfort and airflow, keeping your lap cool during extended use.
- Durable Surface: Work with confidence on our lap desk's solid surface, featuring a sleek black carbon color, ensuring optimal air circulation to prevent your laptop from overheating.
- On-the-Go Convenience: With an integrated handle and lightweight design (2.8 lbs), our lap desk is portable for travel or moving around the house, offering flexibility in any space.
How ChocoShell fits into the operation
CornFlake is the persistent implant
Microsoft describes CornFlake as a Go-based Windows remote-access trojan and the operation’s primary persistent implant. It can enumerate a system, collect files, log keystrokes, take screenshots, capture microphone or camera audio and video, monitor USB devices, and provide remote shell access. It can also serve as a platform for companion tools, including ChocoShell.
ChocoShell collects credentials in memory
ChocoShell is a PowerShell infostealer that Microsoft says executes in memory. Its role in the toolchain is to gather browser and account credentials, tokens, cookies and Wi-Fi credentials. The distinction matters: the report identifies CornFlake and ChocoShell as separate components, not two names for the same malware.
Rank #2
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Why captive-portal Wi-Fi is part of the story
Microsoft reports that the operation manipulated DNS and HTTP traffic on networks served by captive portals, redirecting users through infrastructure controlled by the attackers. A captive portal is the web page that often appears when joining hotel, airport, conference or other guest Wi-Fi. The operation used deceptive browser or operating-system update prompts, including ClickFix-style instructions that try to persuade a person to copy and run a command.
Microsoft observed compromised Wi-Fi networks at hospitality-related organizations and other networks using captive-portal equipment in several countries. The report does not provide a population-level infection count, and the initial compromise method for the affected networks remained under investigation when it was published. Activity in multiple countries should not be mistaken for a measured infection total.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallRank #3
- Note: Not suitable for MacBooks released after 2023 or devices with a protruding front camera; Not applicable to full-screen or notch-style tempered glass screen protectors; Do not use on the rear camera of the phone.
- 💻 Why Do You Need a Webcam Cover Slide? — Safeguard your privacy by covering your webcam with our reliable webcam cover when not in use. Don't let anyone secretly watch you. Stay protected!
- ✅ Thin & Stylish — Enhance your laptop's functionality and aesthetics with our 0.027" ultra-thin webcam covers. Seamlessly close your laptop while adding a touch of sophistication.
- ✅ Fits Most Devices — Compatible with laptops, phones, tablets, desktops! Keep your privacy intact on Ap/ple, Mac/Book, iPh/one, iP/ad, H/P, L/novo, De/ll, Ac/er, As/us, Sa/msung devices.
- ✅ 365 Days Protection — Our upgraded 3.0 adhesive ensures a strong hold that won't damage your equipment. Experience reliable, long-term privacy protection day in and day out.
Microsoft Threat Intelligence assesses Storm-2945 as an operational sub-cluster of Midnight Blizzard, based on technical and operational overlaps. Microsoft attributes Midnight Blizzard to Russia’s Foreign Intelligence Service. These are Microsoft’s attribution assessments, not claims that the report independently proves the actors’ identity.
How to reduce your risk on hotel and public Wi-Fi
Do not follow unexpected update prompts
- Do not paste commands into PowerShell, Command Prompt, or a terminal because a Wi-Fi sign-in page tells you to.
- Do not download a browser, operating-system update, security tool or “required” installer from an unexpected captive-portal prompt.
- Get updates through Windows Update or the software maker’s own trusted update mechanism instead of a link shown on a guest network page.
Use a more trusted connection when practical
For sensitive work, use a private connection you trust when one is available, such as your mobile connection. Microsoft’s guidance says travelers should treat hotel, conference, airport and other guest wireless networks as untrustworthy. This reduces exposure to risky guest-network conditions; it does not protect a computer that is already infected.
Rank #4
- Anti-Slip Surface - Transform your laptop into a mobile workstation with the AboveTEK portable laptop lap desk. The anti-slip surface provides a strong grip for laptops up to 15.6 inches(Diagonal), while the double rubber strip on the bottom ensures a stable display or typing experience on your lap, couch, or bed.
- Retractable Mouse Pad - Retractable laptop mouse pad extends on both directions for the left/right handed with elevation along the edges for stopping mouse from falling off. The size of laptop tray is 14" X 9.7" and the size of mouse pad is 7.4" X 6.1".
- Effective Heat Shield - The effective heat shield made of sturdy and thick material protects your laptop from overheating. Prioritizes your comfort and safety, an ideal lap pad or board for working anywhere.
- EASY to Carry and Store - With an ergonomic and simplistic design, the lap desk is portable to store in a backpack. Only 15" in size, 2.2 lb of weight and with slim 0.6 inch thickness, it is ready to be easily carried around.
- Widely Applicable - The smooth platform accommodates laptops and tablets up to 15.6 inches(Diagonal), making it a versatile accessory and one of the best gifts for mom, dad, students and professionals. Perfect for use as a laptop bed tray or tablet holder anywhere at home, library, or park.
Strengthen account sign-in
Microsoft recommends passkeys and multifactor authentication (MFA). Use them where the service supports them, and, in organizational settings, limit device-code authentication flows where possible. A FIDO2 security key can be one phishing-resistant sign-in option if the account and device support it, but it does not remove malware from a PC or guarantee that an account cannot be compromised.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What to do if you suspect a Windows PC was infected
Microsoft’s report explains what ChocoShell can collect but does not provide a consumer recovery checklist. Because it reports theft of both passwords and active session data, a password change alone may not end access through an already-stolen session. Treat the PC and affected accounts as separate parts of the response:
Recommended Free Tools
Quick Recap
Best Value
- Spacious Design: Measuring 21.1" wide and 12" deep, our lap desk comfortably fits most laptops up to 15.6". Extra room for accessories ensures convenience.
- Enhanced Functionality: Packed with handy features, including a 5x9" precision tracking mouse pad and a built-in phone slot for seamless work or video calls. Plus, enjoy laptop support with the integrated device ledge.
- Cool Comfort: Enjoy a stable surface with our lap desk's dual bolster cushion, designed for comfort and airflow, keeping your lap cool during extended use.
- Durable Surface: Work with confidence on our lap desk's solid surface, featuring a blush pink color, ensuring optimal air circulation to prevent your laptop from overheating.
- On-the-Go Convenience: With an integrated handle and lightweight design (2.14 lbs), our lap desk is portable for travel or moving around the house, offering flexibility in any space.
- Stop using the suspected PC for account access. Disconnect it from networks if you can do so safely, and avoid entering new passwords on it until it has been checked and secured.
- Use a separate, trusted device to secure accounts. Follow each affected service’s official account-security guidance to change exposed passwords, review sign-in activity, revoke sessions or tokens where the service offers those controls, and restore MFA or passkey protection.
- Check organizational accounts with your IT or security team. Microsoft 365 and Azure AD tokens may be involved, so an employer or school administrator may need to revoke sessions and investigate access.
- Have the PC assessed and cleaned using trusted support. Account changes do not remove an implant such as CornFlake or another malware component. Use your organization’s support team or the official guidance for your Windows security software; do not install a cleanup tool offered by an unexpected pop-up.
- Review Wi-Fi access points you administer. If you manage a hospitality or guest network, involve qualified network security staff to investigate its captive-portal equipment and traffic handling.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
