Microsoft Alerts Travelers: Hotel Wi-fi Networks Under Cyber Attack
WHO:
ABC News - Microsoft Threat Intelligence published a warning.
ABC News - The cyber group involved is Storm-2945, a sub-cluster of Midnight Blizzard, also known as APT29 and Cozy Bear.
ABC News - Midnight Blizzard is linked to the Russian Foreign Intelligence Service, or SVR.
WHAT:
ABC News - Microsoft warned about "widespread but targeted" internet traffic manipulation attacks.
ABC News - The hijacking operation is nicknamed "CaptiveCrunch."
ABC News - Microsoft identified a "widespread compromise of Wi-Fi networks at hospitality-related organizations."
ABC News - The attacks were first observed in May.
Inc - Compromised hospitality networks are helping attackers target corporate travelers through deceptive sign-in pages.
WHERE:
ABC News - The attacks are targeting hotels and other hospitality venues worldwide.
WHEN:
ABC News - Microsoft first observed the attacks in May.
WHY:
ABC News - The attacks are attributed to Russian state-sponsored hackers.
HOW:
ABC News - Hackers prompt users to download malicious files after connecting to compromised Wi-Fi networks.
ABC News - The malware collects browser cookies, passwords, documents, and more.
ABC News - Hackers can capture keystrokes, screenshots, audio, and video, monitor the clipboard, and operate the device remotely.
ABC News - Users may be redirected to fake login screens to access their Microsoft 365 accounts.
ABC News - Microsoft listed various fake windows that may appear, including prompts for Windows updates, virus scans, and browser updates.
ABC News - Microsoft advised users to rely on private connectivity, like phone hotspots, rather than public options.
(UPDATED August 4, 2026 00:07 UTC)
Microsoft Threat Intelligence has issued a warning about a cyber group known as Storm-2945, which is a sub-cluster of Midnight Blizzard, linked to the Russian Foreign Intelligence Service. The warning highlights a hijacking operation called "CaptiveCrunch," targeting hotels and hospitality venues worldwide, where compromised Wi-Fi networks are being used to deceive corporate travelers into downloading malicious files. Microsoft advises users to avoid public Wi-Fi and instead rely on private connectivity, as the attacks can lead to significant data theft, including passwords and sensitive documents.