Microsoft Threat Intelligence is alerting on a campaign hijacking hotel and conference centre wi-fi networks worldwide, with Russia-linked intelligence services aiming to steal guests’ credentials and to deliver malware to them.
CaptiveCrunch attack flow. Source: Microsoft
The campaign is named CaptiveCrunch by Microsoft and has compromised captive portal equipment used for sign-in and network access at hotels and other venues offering guest wi-fi since early May 2026.
CaptiveCrunch is attributed by Microsoft to Storm-2945, a sub-cluster of the Russian state-sponsored threat actor Midnight Blizzard.
That same sub-cluster has run artificial intelligence-augmented device code and OAuth phishing campaigns against Microsoft 365 users since February 2026, before escalating in May to compromising the network equipment itself.
From that position, the attackers have redirected travellers to phishing infrastructure and delivered malware disguised as browser or operating system updates, triggered by the automated connectivity checks a phone or laptop runs when it joins a new network.
Midnight Blizzard, tracked internally by Microsoft under its earlier codename NOBELIUM, is attributed by the US and UK governments to Russia’s SVR (Sluzhba Vneshney Razvedki) foreign intelligence service.
Microsoft’s technical analysis said compromises occurred in “several countries” without naming them, and it did not give a total number of affected venues, organisations or individuals.
A related investigation published earlier in July by security firm ReliaQuest, and which Microsoft cited in its report, found compromised captive portal gateways across multiple United States cities as well as in India and Saudi Arabia, mostly at hotels.
ReliaQuest said the traffic it observed came from organisations across financial services, professional services, legal, health care, energy and retail, suggesting the campaign targets travelling employees generally rather than a particular sector.
The two assessments by ReliaQuest and Microsoft point to overlapping tradecraft between Russian intelligence services, although no direct link has been established.
ReliaQuest linked its findings to tradecraft resembling threat actor APT28, which is also tracked as Forest Blizzard.
This is a separate Russian military intelligence-linked group, while Microsoft’s report acknowledged some crossover with a Forest Blizzard DNS hijacking operation it disclosed in April but said it attributes CaptiveCrunch specifically to Storm-2945.
Where attackers gained a foothold, Microsoft said they deployed two main tools: CornFlake, a Windows remote access trojan (RAT) written in Go capable of keylogging, screenshot and webcam capture, audio surveillance and credential and session token theft.
They would also drop ChocoShell, an in-memory PowerShell infostealer targeting browser cookies, saved passwords, Microsoft 365 single sign-on (SSO) tokens and wi-fi credentials.
Microsoft also said it has seen indications the attackers might be targeting Android devices with similar prompts urging victims to download and install an APK file.
Some of the phishing infrastructure redirects users toward Microsoft’s device code authentication flow.
This is a legitimate sign-in method for devices without a browser.
Attackers can abuse the flow by initiating their own sign-in request and tricking the victim into entering the resulting code on a genuine Microsoft page, so the victim ends up authenticating the attacker’s session rather than their own.
ReliaQuest said it found this device code abuse in a limited number of cases and added that roughly one-third of the incidents it examined also involved attempts to abuse Windows’ automatic proxy discovery (WPAD) feature to widen the redirection beyond authentication traffic.
Microsoft recommended organisations to block the Entra ID device code authentication flow through Conditional Access policies where it is not required.
Enforcing multi-factor authentication or passkeys is another recommendation, along with treating hotel, conference and other guest wi-fi networks as untrustworthy.
Instead of untrusted wi-fi, using enterprise-managed travel routers or hotspot devices that tunnel back to trusted corporate infrastructure is recommended.
ReliaQuest separately recommends using an always-on, full-tunnel virtual private network with no split-tunnelling exceptions to close the DNS-poisoning path specifically.
