Microsoft has issued an advisory to travellers regarding the use of free Wi-Fi services at hotels, stating that while it may offer convenient internet access, it also presents significant security risks. Hackers are reportedly targeting these networks to exploit vulnerabilities, potentially compromising users’ personal information, including passwords and sensitive data.

Details of the Hacking Campaign Identified

This alert follows the discovery of a hacking initiative named CaptiveCrunch, which has been actively targeting hotel and guest Wi-Fi networks since early May 2026. The offensive is allegedly linked to Storm-2945, which is a subgroup of the Russian hacking collective known as Midnight Blizzard, also referred to as APT29 or Cozy Bear. Microsoft’s investigation reveals that the primary focus of these hackers is on corporate travellers and their associated accounts, making them prime targets for data theft.

Methodologies employed by the hackers revolve around manipulating Domain Name System (DNS) and Hypertext Transfer Protocol (HTTP) traffic on networks that incorporate captive portals—web pages encountered when logging into public Wi-Fi. By tampering with these pages, attackers can redirect users to illegitimate sites controlled by them, increasing the risk of inadvertent data exposure.

Once users connect to the compromised networks, they may encounter misleading prompts suggesting they install updates or correct issues on their devices. These updates are designed to facilitate greater access for the attacker to hijack sensitive information. Such manipulations may present themselves as fake Windows or browser updates, and some may even masquerade as genuine Google security verifications.

Potential Risks and Theft Mechanisms

Two specific types of malware—CornFlake and ChocoShell—have been identified as tools utilised in the ongoing attacks. CornFlake can extract files, login credentials, and even capture screenshots or record audio and video from affected devices. ChocoShell, on the other hand, targets browser cookies, saved passwords, Microsoft 365 login credentials, and Wi-Fi passwords.

These malware systems allow attackers to surveil device activity closely, gaining access to work-related information and other critical data. The techniques used by Storm-2945 are particularly alarming, as they do not require users to connect to a specifically malicious network, but rather involve sophisticated traffic manipulation and follow-on phishing tactics.

According to Microsoft, the implications of this threat extend beyond immediate data theft, as hackers could potentially manipulate devices to record audio and video or monitor keystrokes, heightening privacy concerns for users.

Best Practices for Travellers Using Hotel Wi-Fi

To mitigate risks while accessing hotel Wi-Fi networks, Microsoft advises travellers to regard such connections as untrusted. Where feasible, it is recommended to utilise mobile hotspots, eSIM services, or other private internet options instead. Users should exercise caution and avoid downloading software updates or other tools directly from Wi-Fi portals.

Should an update be necessary, travellers are urged to obtain it via the official update mechanisms of their device’s operating system or software. By adhering to these precautionary measures, users can significantly reduce the risk of falling victim to cybercrime while travelling.

Microsoft’s warning highlights the need for vigilance amongst travellers who may rely on public Wi-Fi networks, underscoring the importance of cybersecurity in protecting personal and professional information while on the move.

Long or Short, get news the way you like. No ads. No redirections. Download Newspin and Stay Alert, The CSR Journal Mobile app, for fast, crisp, clean updates!

App Store –  https://apps.apple.com/in/app/newspin/id6746449540 

Google Play Store – https://play.google.com/store/apps/details?id=com.inventifweb.newspin&pcampaignid=web_share