Microsoft warns Russian hackers are hijacking hotel Wi-Fi to steal user accounts

Microsoft has warned of a Russian-backed hacking campaign targeting hotel and conference Wi-Fi networks. Dubbed CaptiveCrunch, the operation has been ongoing since early May and is carried out by Storm-2945, a sub-cluster of the Midnight Blizzard group, linked to Russia's Foreign Intelligence Service. The attackers exploit captive portals on hotel Wi-Fi networks to manipulate DNS and HTTP traffic, redirecting users to fake login pages and installing malicious software disguised as legitimate updates.

Microsoft has not disclosed the number of victims, but the campaign targets industries such as financial, legal, healthcare, energy, retail, and professional services. Victims are presented with convincing login pages or fake system update prompts, which can bypass multi-factor authentication. The attackers use custom tools like CornFlake, a remote access trojan, and ChocoShell, an in-memory PowerShell infostealer, to record keystrokes, steal credentials, and exfiltrate files.

Microsoft advises travelers to treat hotel Wi-Fi as untrusted, use a cellular hotspot or private connection, and install updates through trusted mechanisms. Passkeys and phishing-resistant multi-factor authentication are recommended, along with disabling device-code authentication where not required.