Microsoft warns CaptiveCrunch hijacks hotel networks to steal Microsoft logins
If you're traveling and using hotel Wi-Fi, heads-up: Microsoft says a new cyberattack campaign called CaptiveCrunch is targeting people through those familiar login screens.
Hackers linked to Russia's Storm-2945 have been hijacking hotel networks since May 2026, redirecting users to fake websites that steal Microsoft logins or push sketchy downloads.
CornFlake malware risks travelers' work accounts
The main weapon here is CornFlake, a sneaky Windows malware that lets attackers access your files and passwords by pretending to be legitimate system processes.
Android users aren't safe either, with fake app downloads in the mix.
Corporate travelers are especially at risk because hotel and shared Wi-Fi networks can provide attackers with access to people using work accounts and devices.
Microsoft suggests being extra cautious with unexpected login pages or update prompts and says it's teaming up with partners like Anthropic and OpenAI to fight back.