Hotel WiFi Hacks Hit Travelers Harder Than Hotspot Tips Admit

Microsoft Threat Intelligence has tracked a Russian-linked campaign called CaptiveCrunch that has compromised Wi-Fi networks at hotels and other hospitality venues since early May 2026. Attackers redirect guests through fake update prompts and phishing pages to steal Microsoft 365 credentials and plant full-featured malware.

The public advice is straightforward: prefer a mobile hotspot and ignore unexpected pop-ups. That guidance is sound as far as it goes. It also leaves the larger failure modes open.

The Trap at the Captive Portal

Storm-2945, assessed as a sub-cluster of the SVR-linked group Midnight Blizzard (also tracked as APT29 or Cozy Bear), gains an adversary-in-the-middle position on networks that use captive portals. Guests connect, complete the usual hotel login, and their DNS or HTTP traffic is quietly steered through actor-controlled infrastructure.

From there the operators serve two main lures. One is ClickFix-style social engineering that presents fake browser or OS updates and walks the user through paste-and-run commands. The other is lookalike Microsoft domains or device-code authentication flows that trick the victim into authorizing the attacker’s session on a genuine Microsoft sign-in page.

• DNS and HTTP manipulation on the gateway redirects connectivity checks and browsing.
• Fake progress windows mimic Windows Update, Defender scans, DirectX installers or browser updates.
• Device-code phishing abuses a legitimate OAuth flow so MFA succeeds for the wrong party.
• Android APK download instructions appear in some landings.

The two lures share a captive-portal foothold yet diverge in what they ask of the victim. ClickFix needs a paste into a run dialog. Device-code phishing needs only a short code typed into a real Microsoft page. Both paths still begin with the same quiet redirect of DNS or HTTP after the guest finishes the hotel login.

Microsoft notes common equipment and management systems across affected networks, which raises the possibility of shared services inside the captive-portal ecosystem rather than purely one-off hotel breaches. The Microsoft Threat Intelligence CaptiveCrunch analysis first observed the traffic manipulation in early May and published the full write-up on 31 July.

Malware Families Dropped on Guest Devices

The primary Windows implant is CornFlake, a Golang remote-access trojan that starts in dropper mode with a convincing fake progress window. It installs as a service named svchost32 under the display name Cloud Sync Service, sets multiple persistence mechanisms, and opens an encrypted C2 channel with ephemeral keys.

A companion in-memory PowerShell tool called ChocoShell focuses on high-value credentials: browser session cookies, saved passwords, Microsoft 365 SSO and WAM tokens, and Wi-Fi profiles. It disables AMSI, runs sandbox checks, escalates via three silent UAC bypasses when the user is a local administrator, and locks Defender signature updates while it works. Microsoft observed AI support for a significant share of the operations and thanked Anthropic and OpenAI for collaboration during the investigation.

Together the pair covers both persistence and fast credential harvest. CornFlake stays resident as a service and keeps the encrypted channel alive. ChocoShell runs in memory, strips tokens and Wi-Fi profiles, then leaves a smaller footprint once the high-value material is gone. Operators who already hold an adversary-in-the-middle position on the gateway can choose which payload fits the guest device in front of them.

ReliaQuest earlier documented the gateway layer. Compromised captive-portal appliances in multiple US cities plus India and Saudi Arabia used DNS poisoning to steer Microsoft authentication domains to attacker hosts such as owa-ms365[.]com. The ReliaQuest gateway compromise findings assessed the goal as corporate travelers’ Microsoft 365 accounts and noted traffic from financial services, legal, healthcare, energy and retail organizations.

Why the Hotspot Tip Only Goes So Far

Microsoft’s own mitigation section opens with a clear line:

When traveling, users should treat hotel, conference, airport, and other guest wireless networks as untrustworthy.

Prefer private connectivity including mobile hotspots, satellite or eSIM data. Avoid any software, certificates or troubleshooting tools offered through the portal. Those steps cut exposure. They do not eliminate it.

A full-tunnel VPN is powerful once established, yet the captive-portal authentication window occurs before the tunnel comes up. Connectivity probes fire in that interval and can deliver the initial payload. Device-code phishing runs against legitimate Microsoft endpoints; the victim types an attacker-supplied code into a real sign-in page and authorizes the wrong session. No malicious destination exists for a tunnel to block. ClickFix ultimately relies on a human pasting a command; network controls cannot mediate that paste.

Several gaps remain even when a traveler follows the common advice:

• The captive-portal window opens before any full-tunnel VPN can protect traffic.
• Device-code phishing completes on genuine Microsoft sign-in pages, so destination blocking never fires.
• ClickFix depends on a user paste that no network filter can intercept.
• A resident RAT can later ride an approved VPN back into the corporate estate.

Security practitioners on X have made the same point in sharper language. One detailed thread argued that “don’t use hotel Wi-Fi” is the laziest control in security because the captive portal is mainly a pretext amplifier, not a unique vulnerability class. The same chain works from malvertising, a compromised site or a QR code. Once the RAT is resident the VPN can become a clean path back into the corporate estate.

Who Sits in the Crosshairs

The campaign is not random guest phishing. ReliaQuest and Microsoft both point to corporate and government travelers whose Microsoft 365 accounts yield intelligence value. Midnight Blizzard’s long-standing focus is governments, diplomatic entities, NGOs and IT providers in the US and Europe; Storm-2945 inherits that victimology while expanding access methods.

Industries observed in the gateway traffic include financial services, professional services, legal, healthcare, energy and retail. A single compromised hotel or conference gateway exposes every guest that day. Conference centers and shared venues expand the surface beyond lodging.

The concentration of high-value accounts on ordinary guest networks is the point. A diplomat, a counsel, and an energy executive may share the same lobby SSID for a single afternoon. Operators who poison DNS at that gateway collect from all of them without crafting separate spear-phish mail for each target.

Travelers who reuse corporate credentials on hotel registration pages or who accept local-admin rights on laptops hand the operators easier paths. The malware harvests Wi-Fi credentials with netsh as additional loot, turning the network profile itself into a prize.

Portal Gear and the Shared Services Layer

Investigation into the initial vector for the captive-portal networks remains open. Microsoft observed notable commonalities in equipment and management systems, suggesting possible access to shared services rather than purely isolated venue compromises. ReliaQuest assessed with low-to-medium confidence that exposed management interfaces (SSH, SNMP, web consoles) plus weak or reused admin credentials played a role.

That framing shifts part of the burden onto hospitality operators and the vendors who supply or manage their guest-network gear. A single appliance at the perimeter controls DNS for every client. Weak perimeter hygiene at the venue becomes an intelligence collection opportunity for a state actor.

Earlier 2026 activity against SOHO routers (the Forest Blizzard DNS-hijacking campaign Microsoft disclosed in April) used overlapping traffic-manipulation ideas. CaptiveCrunch is attributed separately to Storm-2945, yet the reuse of gateway-level DNS poisoning shows how quickly tradecraft migrates from home routers into hospitality environments.

The pattern across both campaigns is the gateway as a chokepoint. Whoever steers DNS for a block of clients can present fake updates, poison authentication hostnames, or both. Hospitality gear that still exposes management interfaces or reuses admin passwords widens that chokepoint from a single venue into a reusable collection layer.

How the Guest Path Reaches C2

The operational sequence is short once the guest joins the poisoned network. Each step reuses controls the traveler already expects from a hotel login or a Microsoft sign-in.

1. Early May 2026 – Microsoft first observes the traffic manipulation on hospitality captive portals.
2. Guest joins Wi-Fi – the traveler completes the usual portal login and appears online.
3. DNS or HTTP steering – connectivity checks and browsing pass through actor-controlled infrastructure.
4. Lure delivery – fake update prompts, lookalike Microsoft domains, or device-code flows appear.
5. Payload and harvest – CornFlake persists as Cloud Sync Service; ChocoShell lifts SSO tokens, cookies, and Wi-Fi profiles.
6. 31 July 2026 – Microsoft publishes the full CaptiveCrunch write-up.

ReliaQuest’s earlier gateway work sits inside that same window. Compromised appliances across multiple US cities, India, and Saudi Arabia already showed DNS poisoning aimed at Microsoft authentication domains. The later Microsoft analysis tied the guest-facing lures and the malware families to Storm-2945 and the wider Midnight Blizzard cluster.

Nothing in the chain requires a malicious app store or a spear-phish attachment. The portal, the fake progress window, and the legitimate OAuth device-code page do the social engineering. Persistence and token theft follow only after the guest has cooperated with a prompt that looked routine.

Why Shared Venues Multiply Exposure

A compromised lodging gateway is already serious. Conference centers and other shared venues stretch the same compromise across organizations that never intended to share a network trust boundary. One poisoned DNS path serves every badge scanned that day.

ReliaQuest noted gateway traffic tied to financial services, legal, healthcare, energy, and retail. Those sectors often send staff to the same industry events. A single appliance therefore concentrates credentials that would otherwise sit behind separate corporate perimeters.

Midnight Blizzard’s historic interest in governments, diplomatic entities, NGOs, and IT providers in the US and Europe fits this venue model. Storm-2945 keeps that victimology and adds hospitality access as the delivery path. The operators do not need to guess which guest matters. They collect broadly and sort for intelligence value afterward.

Wi-Fi profiles pulled by netsh extend the prize beyond the current stay. A harvested profile can reveal corporate SSIDs, saved keys, and roaming habits that support later operations against the same traveler or the same employer network.

Practical Locks That Close the Path

Identity and endpoint configuration stop more of the chain than travel posters. Microsoft recommends organizations block device code flow where possible and allow it only by exception for genuine headless devices. Require compliant or hybrid-joined devices for sign-in. Prefer phishing-resistant MFA such as passkeys. Apply sign-in risk policies and continuous access evaluation so a high-risk session is challenged or revoked.

On the device side, remove standing local-admin rights. ChocoShell’s silent UAC bypasses and SYSTEM token impersonation for Chrome ABE decryption fail when the user is a standard account. Application control (WDAC or Smart App Control), PowerShell Constrained Language Mode, attack-surface reduction rules and tamper protection further shrink the RAT’s room to run. Disable browser remote-debugging ports by policy so the DevTools Protocol cookie dump path is closed.

Controls that map directly to observed tradecraft include:

• Block or tightly exception device-code flow so attacker-supplied codes cannot complete OAuth.
• Enforce compliant or hybrid-joined devices before Microsoft 365 sign-in succeeds.
• Strip standing local admin so silent UAC bypasses and SYSTEM impersonation fail.
• Turn on WDAC or Smart App Control, Constrained Language Mode, ASR rules, and tamper protection.
• Close browser remote-debugging ports to block DevTools Protocol cookie dumps.

Enterprise travel kits can include managed hotspots or travel routers that establish encrypted tunnels before sensitive work begins. MDM policies can restrict manual Wi-Fi connections to provisioned networks only. For connectivity options that sidestep public gateways entirely, some rail operators already trial satellite WiFi alternatives for travelers.

The same intelligence agencies that once relied on phishing emails now harvest tokens and implants through everyday infrastructure. Parallel campaigns show how quickly AI-assisted tooling spreads; recent AI-discovered webshell malware waves illustrate the same acceleration on the web side. CaptiveCrunch simply moved the collection point to the hotel lobby.

Organizations that treat traveler security as a briefing deck and a VPN license still have an open door. Those that lock authentication flows, enforce device compliance and strip local admin close the door for this campaign and the next one that uses a different delivery pretext.