Beware of hotel Wi-Fi: Microsoft warns of cyberattack campaign
What's the story
Microsoft has issued a warning about a cyberattack campaign targeting public Wi-Fi networks at hotels and other hospitality venues. The campaign, dubbed "CaptiveCrunch," has been active since at least May. It involves compromising the Wi-Fi infrastructure and captive portals that connect guests to the internet. The attacks have been attributed to Storm-2945, a group linked to Russian threat actor Midnight Blizzard (also known as APT29 or Cozy Bear).
Attack method
How the attack works
The attackers first compromise the network infrastructure or equipment responsible for captive portals, which are the web pages users see after connecting to public Wi-Fi networks.
Once compromised, they can manipulate these pages to trick victims into installing malware or entering their credentials on fake login screens.
Some fake pages mimic legitimate Windows or Google services, while others redirect users to counterfeit login screens that harvest Microsoft 365 credentials.
Risk assessment
What hackers can do with stolen credentials
Stolen credentials from these attacks could give hackers access to emails, OneDrive files, and corporate systems.
The malware used in these attacks can provide extensive access to compromised devices.
Depending on the infection, attackers may be able to capture keystrokes, record audio/video, take screenshots, steal browser cookies/passwords, and remotely control the affected computer.
Warning signs
Fake tools presented to users
Microsoft has identified several types of fake tools that may be presented to users, including counterfeit Windows Update and Windows Security screens, fake DirectX and Visual C++ installers, and bogus network diagnostic utilities.
The presence of such a request immediately after joining a hotel network should therefore be treated with caution.
Safety tips
Microsoft's recommendations to stay safe
Microsoft recommends avoiding hotel and other public Wi-Fi networks whenever possible, opting for a personal cellular hotspot or another encrypted private connection instead.
Travelers should also avoid downloading software, browser updates, security tools, or network certificates offered through captive portals or unexpected pop-ups.
Users should obtain updates directly from the official website or the device's built-in update system.