{
  "id": 132472,
  "title": "Travelers beware — Microsoft experts warn hotel Wi-Fi can be hijacked to infect your devices with dangerous malware",
  "url": "https://urgent.news/2026/08/04/travelers-beware-microsoft-experts-warn-hotel-wi-fi-can-be-hijacked",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-04T13:00:00.000Z",
  "source": {
    "name": "TechRadar",
    "slug": "techradar",
    "url": "https://www.techradar.com/pro/security/travelers-beware-microsoft-experts-warn-hotel-wi-fi-can-be-hijacked-to-infect-your-devices-with-dangerous-malware"
  },
  "original_language": "en",
  "account": "Microsoft experts caution travelers about the potential for hackers to hijack hotel Wi-Fi networks and infect devices with malware. Russian state-sponsored actors, identified as Midnight Blizzard or APT29, have been targeting captive portal equipment - the hardware and software that manages the login page before users can access public Wi-Fi. When users attempt to connect to these networks, they may be redirected to fraudulent Microsoft 365 login pages or bogus update pages, which can lead to the spread of two types of malware: CornFlake and CocoShell.\n\nCornFlake operates as an information stealer, capable of capturing keystrokes, clipboard data, executing remote shell commands, capturing screenshots, accessing webcams and microphones, stealing browser credentials and cookies, and exfiltrating files. In contrast, CocoShell is an in-memory PowerShell credential stealer that targets browser cookies, saved passwords, Microsoft 365 and Azure AD tokens, and Wi-Fi credentials.\n\nThe researchers from Microsoft did not specify how the attackers gain control over the captive portal equipment, but stressed the importance of travelers being vigilant when connecting to public Wi-Fi networks in hotels and conference centers.",
  "summary": "Russian criminals are targeting hotel Wi-Fi networks with captive portals and using them to deploy infostealers.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "TechSpot",
        "title": "Microsoft warns Russian hackers are hijacking hotel Wi-Fi to steal user accounts",
        "url": "https://urgent.news/2026/08/04/microsoft-warns-russian-hackers-are-hijacking-hotel-wi-fi-to-steal",
        "published": "2026-08-04T14:44:00.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}