Microsoft reports a Russian state-backed operation that compromises hotel and conference Wi‑Fi “captive portals” to redirect travelers to fake Microsoft 365 sign-in pages or fake update prompts that install malware. One method abuses Microsoft’s device-code login flow so victims unknowingly approve the attacker’s session, potentially bypassing MFA. The campaign appears aimed at corporate travelers across many industries rather than a single sector.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You join hotel Wi‑Fi, click past the terms page… and suddenly you’re staring at a Microsoft 365 login screen. Microsoft says a Russian state-backed group is hijacking hotel and conference captive portals, silently redirecting you to fake M365 logins or a real Microsoft device-code page where you enter their code and unknowingly approve their session. Red flags: the M365 login pops up right after joining guest Wi‑Fi, extra redirects or repeated prompts, or a device code you never asked for while just trying to get online. That’s not normal Wi‑Fi behavior. When you travel, treat hotel, conference, and airport Wi‑Fi as untrusted, use your phone’s hotspot instead, and never enter a device code or M365 password you didn’t personally start the sign-in for.
Microsoft says a Russia-linked group compromised hotel and venue Wi‑Fi captive portals to show convincing fake prompts during the normal “connect to Wi‑Fi” flow. The prompts try to trick travelers into installing malware, running commands, or approving a Microsoft sign-in that grants the attacker…
Microsoft and ReliaQuest report a real campaign where Russian-linked hackers compromised hotel Wi‑Fi networks and redirected travelers to fake Microsoft login pages or fake update screens. The goal was to steal Microsoft 365 credentials and/or trick victims into installing espionage malware,…
Attackers hijacked hotel/captive-portal Wi‑Fi infrastructure to redirect travelers to fake browser or operating system update pages and trick them into installing spyware. The operation (tracked as CaptiveCrunch) used DNS manipulation and user prompts (including “ClickFix” instructions) to get…
Microsoft says Russian-linked threat actors compromised hotel and conference guest Wi‑Fi “captive portal” networks to redirect travelers to fake Microsoft 365 sign-in pages, device-code phishing, or fake update pages. The goal was to steal cloud credentials (including Entra ID device codes) and…
Microsoft says a Russian-linked group is abusing hotel and conference Wi‑Fi “captive portals” to trick travelers into entering corporate credentials or installing malware. Victims see what looks like a normal Wi‑Fi login flow, but attackers manipulate DNS/website traffic to redirect them to fake…
Microsoft says a Russia-linked group compromised hotel and conference guest Wi‑Fi sign-in systems to redirect travelers to phishing pages and fake “update” prompts. The goal was to steal credentials (including Microsoft 365) and push malware when devices automatically check connectivity after…
