Hotel Wi-Fi Under Siege: Microsoft Exposes Russian Hacking Scheme

A high-stakes cyber threat is looming over hotel Wi-Fi networks worldwide, courtesy of a sophisticated hacking campaign dubbed 'CaptiveCrunch.' This operation, orchestrated by Storm-2945, a subgroup of the Russian state-sponsored hacking collective Midnight Blizzard, has been exploiting vulnerabilities in hotel Wi-Fi networks since early May. The modus operandi involves redirecting users to fake Microsoft 365 websites or prompting them to download malicious software masquerading as legitimate updates, known as CornFlake malware. This malware is capable of pilfering sensitive information such as keystrokes, screenshots, and browser cookies and passwords. The hackers employ 'ClickFix' tactics, displaying fake update screens or virus scans to deceive users into downloading the malware. In some cases, victims are coerced into entering device codes on Microsoft's legitimate authentication page, a technique known as device code phishing, granting the attackers access to business accounts. To safeguard against these threats, travelers are advised to opt for private connections like mobile hotspots instead of public Wi-Fi and refrain from downloading software updates via captive portals.