Hotel Wi-Fi Is Becoming an Espionage Delivery System

Microsoft has exposed a worldwide campaign that turns hotel Wi-Fi into an entry point for malware, credential theft, and corporate espionage. The Microsoft source investigation says the operation has manipulated hospitality networks since early May 2026. It targets travelers when routine connection prompts feel most trustworthy.

The campaign, named CaptiveCrunch, is linked to Storm-2945, which Microsoft assesses is an operational sub-cluster of Midnight Blizzard. Western governments attribute that broader threat group to Russia’s Foreign Intelligence Service, or SVR. Its traditional targets include governments, diplomats, nongovernmental organizations, and technology providers.

That history creates the central conflict. A hotel login page looks like consumer infrastructure, yet the traveler behind it might provide access to a government or corporate environment. CaptiveCrunch turns that moment of convenience into a route around defenses protecting email, cloud files, and identity systems.

Microsoft has observed both malware delivery and adversary-in-the-middle phishing, where an attacker secretly intercepts or redirects traffic between a user and an online service. Some victims encounter fake updates or verification instructions. Others are directed into a legitimate Microsoft authentication process that authorizes an attacker’s session.

The result is more serious than ordinary public Wi-Fi snooping. The attacker does not need every traveler. It needs selected people whose devices, browser sessions, or Microsoft 365 identities lead to higher-value networks.

The Microsoft Source Investigation Changes the Travel Threat Model

CaptiveCrunch makes the network itself part of the social engineering attack.

According to the CaptiveCrunch investigation, Microsoft began observing the hospitality-network attacks in early May 2026. Storm-2945 had already conducted AI-assisted device-code and OAuth phishing operations since February.

The campaign manipulates Domain Name System and unencrypted HTTP traffic associated with captive portals. A captive portal is the sign-in or acceptance page shown before a guest network grants internet access. Travelers commonly expect these pages at hotels, airports, conference centers, and shared workspaces.

That expectation gives the attacker useful cover. A delayed connection, browser check, or update request does not immediately appear suspicious after someone joins an unfamiliar network. The surrounding circumstances help authenticate the deception before the victim evaluates its technical details.

Microsoft says compromised networks redirect traffic through attacker-controlled infrastructure. The destination can present a fake browser update, operating-system repair, security scan, or network diagnostic. ClickFix social engineering then pressures the user to download a file or run copied commands.

ClickFix attacks are effective because they reframe execution as troubleshooting. A victim believes the browser or network has identified a problem. The instructions then persuade that person to perform the action that security controls would otherwise block.

Microsoft has also seen landing pages route travelers toward device-code authentication. Device-code flow is a legitimate OAuth process for devices that cannot provide a normal sign-in interface. A user visits a real authentication page and enters a short code displayed elsewhere.

The deception lies in who started the session. The attacker creates the authentication request, then persuades the victim to enter the attacker’s code. If the victim approves access, the legitimate identity provider authorizes the attacker’s session.

This technique is not new. Microsoft previously documented Midnight Blizzard using device-code phishing through messaging platforms. CaptiveCrunch changes the setting by placing the request inside a network-registration experience, where authentication already feels expected.

Microsoft says the activity has affected hospitality networks and other captive-portal environments in several countries. ReliaQuest has also identified activity involving hotels, conference centers, and other shared venues. The available reporting does not provide a complete list of locations or victim organizations.

The investigation has not determined how Storm-2945 first gained access to the affected portal infrastructure. Microsoft found common equipment and management systems across several networks. It says those similarities suggest access to shared services within the captive-portal ecosystem, rather than unrelated compromises at every venue.

That remains an assessment, not a confirmed supply-chain finding. A shared service could explain the campaign’s reach, but Microsoft’s investigation is ongoing. The distinction matters for hotel operators deciding whether to inspect one property or an entire managed network.

The campaign also includes possible Android targeting. Microsoft found ClickFix landing instructions that directed Android users to install an APK package. The company describes these as indications, while its most detailed malware analysis concerns Windows systems.

The lasting change is therefore broader than one malicious domain or hotel. Travelers can no longer treat a familiar captive portal as evidence that the next prompt came from the venue. The attacker can exploit trusted network behavior without perfectly imitating the hotel’s brand.

Corporate Travelers Have Become Moving Access Points

The traveler is valuable because identity and cloud access move with the employee.

Midnight Blizzard has historically pursued intelligence rather than indiscriminate financial theft. The APT29 profile maintained by MITRE connects the group to long-running operations against governments, research bodies, diplomatic targets, and technology organizations. Compromised accounts often support persistence, intelligence collection, and lateral movement.

Business travel creates an unusual concentration of opportunity. Employees carry managed laptops, authentication apps, browser sessions, corporate email, local documents, and saved network profiles. They also operate outside familiar offices and established support channels.

A traveler facing a broken hotel connection often has immediate pressure to get online. The person might need to join a meeting, retrieve a presentation, or respond to a customer. That urgency favors the attacker because troubleshooting instructions can appear more reasonable than waiting for corporate support.

CaptiveCrunch also compresses several forms of context into one moment. The venue knows the guest’s location and stay. The device exposes its operating-system behavior. The browser expects a connectivity check. The user expects a registration page and might anticipate entering identifying information.

Those signals help attackers select or shape a lure. Microsoft says Storm-2945 used AI during a significant portion of the operation. It does not claim that AI independently conducted the attacks, selected every victim, or created every malware component.

The available evidence instead suggests AI supported operational work. Microsoft notes that one PowerShell component contains detailed developer comments and consistent explanations of evasion decisions. Investigators assessed that the author might have used AI-assisted code generation.

That possibility matters less than the campaign’s integration. Traffic manipulation brings a traveler to the lure. Social engineering triggers execution or authentication. Malware collects device data, while stolen tokens can provide access to cloud services.

Traditional employee awareness programs often teach users to inspect email senders and links. CaptiveCrunch begins before an email arrives. A browser can open a portal automatically after the operating system detects restricted connectivity.

Corporate defenses also tend to divide responsibilities. A travel team books accommodation, network teams manage connectivity, identity teams configure authentication, and endpoint teams investigate malware. The attack crosses those boundaries within a single session.

Hotel operators face a related problem. Many properties outsource parts of their guest-network infrastructure, including portal management, authentication, analytics, or support. Microsoft has not publicly identified which shared systems, if any, account for the observed commonalities.

Without that attribution, every participant has an incomplete view. A venue might see a temporary network problem. A managed-service provider might see unusual traffic. An enterprise security team might receive an endpoint alert after the employee returns.

The forced response must therefore extend beyond telling employees to use caution. Enterprises need travel-specific controls that assume the local network can modify traffic. They also need identity policies that limit what one successful interaction can authorize.

Mobile hotspots reduce exposure to compromised guest infrastructure, but they do not solve every travel situation. Coverage, roaming restrictions, device policies, and local conditions can still push employees toward venue Wi-Fi. Some conferences also operate in buildings with weak cellular reception.

A virtual private network can encrypt traffic after it connects, but it is not a universal answer. The device might interact with the captive portal before the tunnel starts. A user can still approve a malicious device code or execute a fake update while the VPN is active.

Security teams should treat travel as a distinct risk state. New network connections, unusual locations, fresh device registrations, and device-code authentication can become combined signals. A single signal might be legitimate, while the sequence deserves closer inspection.

Organizations also need a reliable way to preserve travel reports, indicators, and response decisions. A searchable engineering knowledge base can help incident teams connect endpoint evidence with earlier cases. It should complement, not replace, formal security logging and case management.

CaptiveCrunch Turns Connectivity Checks Into Malware Delivery

The campaign’s main advantage is timing, since it inserts malicious choices into behavior the device already initiated.

Modern operating systems check whether a network provides open internet access. If the check detects a captive portal, the device can open a limited browser window. CaptiveCrunch abuses that transition by manipulating DNS or HTTP traffic and placing attacker-controlled infrastructure in the path.

A fake update is especially persuasive in this context. The traveler has just joined an unfamiliar network and sees a technical interruption. A browser repair or security check offers a plausible explanation for why the connection has not completed.

Microsoft documented several false interfaces associated with the campaign. They resemble Windows Update, Windows Security, DirectX installation, browser updates, network diagnostics, disk optimization, and document-viewer installation. Their purpose is to hold attention while malicious code runs.

The primary persistent implant is CornFlake, a Windows remote-access trojan written in Go. A remote-access trojan, or RAT, lets an operator monitor and control an infected computer. Microsoft says Storm-2945 has rapidly revised this malware layer.

CornFlake can display a convincing progress screen while copying itself into an application-data folder. It registers a Windows service called “Cloud Sync Service” and uses a filename resembling the legitimate Windows service-host process. Those labels are designed to look ordinary during casual inspection.

The malware establishes persistence through several mechanisms. Microsoft found service registration, Registry Run keys, scheduled tasks, and a watchdog routine. If one mechanism disappears, the watchdog can restore it.

Once active, CornFlake supports keylogging, clipboard monitoring, screenshots, microphone recording, webcam capture, file collection, and removable-drive monitoring. It can also open a remote command shell. Operators can enable selected capabilities through configuration settings.

The malware performs a detailed security-posture survey as well. Microsoft says it collects information about installed software, endpoint protection, Defender exclusions, User Account Control settings, recent Office files, and Remote Desktop history. That inventory helps operators understand both the target’s value and its defenses.

CornFlake communicates with command infrastructure through an encrypted channel. Each session uses an ephemeral key exchange, making captured traffic difficult to decrypt without the corresponding private key. Its configuration can also update command servers and collection targets without reinstalling the implant.

A second component, ChocoShell, focuses on rapid credential and session theft. It is a PowerShell infostealer executed in memory, meaning much of its activity does not depend on a conventional file saved to disk. Its targets include saved passwords, browser cookies, Microsoft 365 tokens, and Wi-Fi credentials.

Session tokens deserve particular attention. A session token tells a service that a user has already authenticated. If an attacker steals and replays a valid token, the attacker might access cloud data without entering the victim’s password again.

ChocoShell targets several Chromium-based browsers, including Edge and Chrome, as well as Firefox-family browsers. Microsoft says it uses multiple methods to reach browser data. One method launches a browser with remote debugging enabled and asks the browser to return decrypted cookies.

The malware also collects access tokens, refresh tokens, and Web Account Manager tokens from Windows caches. These artifacts can expose Microsoft 365 or cloud sessions. The attacker’s objective can therefore move quickly from one traveling laptop to email and organizational data.

Administrative privileges expand the damage. Microsoft found several User Account Control bypass methods, plus a visible elevation request if silent approaches fail. The malware can impersonate a system process for protected browser-data access and interfere with Defender signature updates.

After collection, ChocoShell compresses and encodes the data before sending it to command infrastructure. It then removes temporary scripts and checks that certain registry changes were cleaned. These steps reduce obvious traces without guaranteeing the attack becomes invisible.

Storm-2945 manages infected devices through a web-based command panel Microsoft calls FruitStone. The interface tracks machines, operator sessions, stolen information, infrastructure health, and payload settings. Its branding imitates an ordinary enterprise cloud-management console.

This is where CaptiveCrunch looks less like a one-off phishing kit and more like an operational system. Operators can configure payloads, rotate relays, alter collection settings, and review victims by geography. The hotel portal supplies access, but the infrastructure supports sustained exploitation afterward.

The mechanism also explains why common advice about HTTPS is insufficient. Encrypted websites protect their own sessions, yet the traveler can still be redirected during a connectivity check. A fake update or device-code request can persuade the user to leave the protected path voluntarily.

Public Wi-Fi Is the Lure, but Identity Is the Prize

The campaign succeeds when a normal-looking sign-in bridges an untrusted network and a trusted cloud identity.

Device-code phishing shows the tradeoff most clearly. Microsoft built device-code authentication for valid scenarios, such as televisions, command-line tools, and devices with limited input capabilities. The user completes authentication on another device with a normal browser.

That design separates the requesting device from the approving user. An attacker abuses the separation by starting the request and sending its code to the victim. The victim sees a genuine Microsoft page but approves a session controlled elsewhere.

A password manager cannot prevent that mistake because the victim is not typing a password into a counterfeit site. Conventional multifactor authentication might also fail to stop it if the user knowingly approves the legitimate prompt. The protection decision depends on understanding which session receives authorization.

This is why Microsoft recommends blocking device-code flow wherever an organization does not need it. Where business use requires the workflow, administrators can constrain it through Conditional Access. Policies can consider identity, device condition, location, application, and sign-in risk.

Phishing-resistant authentication still improves the broader defense. Passkeys and hardware-backed credentials bind authentication more closely to the legitimate service. Microsoft’s MFA guidance notes that passwords, one-time codes, and push approvals remain vulnerable to interception, social engineering, or user fatigue.

However, no single authentication method neutralizes every CaptiveCrunch path. Passkeys do not prevent a user from installing malware presented as an update. Endpoint protection does not automatically prevent someone from authorizing an attacker’s OAuth session.

The defensive objective is to break the chain at several points. Organizations can restrict unmanaged Wi-Fi, block unnecessary device-code authentication, require managed devices, evaluate sign-in risk, and investigate new device registrations. They can also revoke sessions when endpoint compromise is suspected.

Microsoft recommends private connectivity, including cellular hotspots and eSIM data, when practical. It also advises travelers not to install software, certificates, browser updates, or repair tools presented by a captive portal. Updates should come through trusted operating-system or application mechanisms.

Travelers should never paste commands into PowerShell, Command Prompt, or another script host because a network page requests it. A verification page does not need terminal access to confirm that a person is human. Paste-and-run instructions are a strong sign of ClickFix activity.

Organizations should also limit local administrator rights on travel devices. ChocoShell has fallback paths, but several of its most damaging capabilities require elevation. Removing routine administrative access can turn silent escalation into a visible prompt or block it altogether.

Microsoft advises companies to review the information employees disclose during guest-network registration. Workers should not reuse corporate credentials on hotel or conference portals. They should minimize unnecessary details about their employer, role, or travel plans.

That recommendation highlights an uncomfortable overlap between hospitality data and targeting. A guest’s affiliation can help an intelligence operator distinguish an ordinary vacationer from a diplomat, executive, researcher, or administrator. Microsoft has not said that every affected venue leaked registration records.

The campaign also pressures hospitality providers. Guest Wi-Fi can no longer be treated solely as an amenity measured by coverage and speed. Portal integrity, vendor access, DNS behavior, software updates, and security monitoring now affect customers’ enterprise identities.

Still, Microsoft’s findings have limits. The company has not disclosed the number of infected travelers, compromised properties, affected countries, or successful cloud intrusions. “Widespread but targeted” describes operational reach, not a measured victim total.

The initial access into captive-portal environments remains unresolved as well. Shared equipment and management similarities point toward an ecosystem-level weakness, but they do not establish one universal vulnerability. Defenders should avoid assuming that replacing a single vendor closes the campaign.

Attribution also rests on Microsoft’s assessment of technical and operational overlaps. The company links Storm-2945 to Midnight Blizzard and cites similarities in device-code phishing, Microsoft Graph data collection, victim selection, and messaging-based social engineering. Independent public evidence remains more limited.

These uncertainties do not erase the observed malware, domains, or attack techniques. They define the boundaries of what the Microsoft source can currently support. Security teams can act on the documented behaviors without treating every public Wi-Fi failure as Russian espionage.

Three Signals Will Show Whether CaptiveCrunch Is Contained

The next phase depends on shared-infrastructure findings, identity telemetry, and whether the attackers rotate their delivery system.

The first signal is a confirmed explanation for the captive-portal compromises. Microsoft says its investigation into initial access is continuing. Identification of a shared provider, management platform, credential exposure, or exploitable device would strengthen the ecosystem-level interpretation.

That finding would change the response. Hotels could identify affected technology and coordinate remediation across properties. Enterprises could map employee travel against known providers instead of treating every guest network as equally exposed.

A series of unrelated property compromises would weaken the single-ecosystem theory. It would also show that attackers can reproduce the operation across varied network stacks. That outcome might make containment slower because defenders would lack one central remediation path.

The second signal is identity activity associated with device-code authentication and new device registration. Microsoft says Storm-2945 used these methods for cloud data collection before CaptiveCrunch appeared. Enterprises should examine whether travel-related sessions produce unusual OAuth approvals, token use, or mailbox access.

A decline following stricter Conditional Access would support Microsoft’s recommended controls. Continued compromise despite blocked device-code flow would suggest that stolen browser sessions, malware, or alternative authentication paths are carrying more of the operation.

Identity teams should coordinate with endpoint teams during this review. A suspicious cloud session might be the first visible sign of a hotel-network infection. Conversely, a fake-update download can justify revoking active sessions before investigators confirm token theft.

Microsoft provides hunting guidance for file creation after captive-portal connectivity checks. One query correlates executable or archive creation within two minutes of a device’s network test. Microsoft cautions that not every match is malicious.

The third signal is infrastructure and payload rotation. Microsoft published domains, internet addresses, file hashes, service names, and behavioral detections linked to observed activity. Those indicators help immediate hunting, but sophisticated operators often replace exposed infrastructure.

Defenders should watch for new domains imitating Microsoft services, unexpected connectivity-test redirects, and revised fake-update workflows. They should also monitor behavior that survives cosmetic changes, including unusual scheduled tasks, browser remote debugging, token-cache access, and network-triggered downloads.

Rapid rotation would strengthen the judgment that CaptiveCrunch is an ongoing operational platform. Long-term disappearance after infrastructure disruption would suggest the public disclosure imposed meaningful costs. Neither result would prove the actor had lost access to hospitality networks.

The use of AI is another supporting signal, though it should not become the main story. Microsoft thanked Anthropic and OpenAI for collaboration during the investigation and says Storm-2945 used AI across part of its operations. Future disclosures might clarify whether model access improved targeting, coding, localization, or infrastructure management.

For travelers, the immediate action is simpler than the attribution debate. Prefer a trusted cellular connection, reject portal-delivered software, and verify updates through the device’s own settings. Never enter a device code unless you personally initiated the sign-in.

For enterprises, travel security should become a connected identity, endpoint, and network program. Restrict unnecessary authentication flows, require phishing-resistant methods, remove routine local administrator access, and rehearse rapid token revocation. Treat public connectivity as hostile before a specific hotel appears on a warning list.

The Microsoft source report leaves important questions unanswered, especially how portal infrastructure was compromised and how many travelers were affected. Its central warning is already clear. The next hotel Wi-Fi prompt might not simply ask for access to the internet; it might ask for access to the traveler’s organization.