Russian state hackers compromise hotel Wi-Fi networks worldwide.
Microsoft has attributed an ongoing espionage campaign called CaptiveCrunch to Storm-2945, a subgroup of the Russian state-linked Midnight Blizzard operation. The attackers compromise hotel, conference-centre and other hospitality Wi-Fi infrastructure, manipulating DNS and HTTP traffic to redirect travelers to fake Microsoft authentication pages or fraudulent software updates. The campaign delivers malware capable of stealing passwords, Microsoft 365 tokens, files and Wi-Fi credentials, while also recording keystrokes, audio and video. Microsoft has observed affected networks in several countries, with corporate travelers appearing to be the principal targets.