Microsoft says Russian-linked threat actors compromised hotel and conference guest Wi‑Fi “captive portal” networks to redirect travelers to fake Microsoft 365 sign-in pages, device-code phishing, or fake update pages. The goal was to steal cloud credentials (including Entra ID device codes) and trick victims into running malware under the guise of browser/OS updates.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You join hotel Wi‑Fi, and boom, before the internet even works, a perfect Microsoft 365 login pops up. Microsoft calls this campaign CaptiveCrunch. Compromised hotel and conference Wi‑Fi quietly hijack DNS and HTTP, then redirect you to fake Microsoft 365 sign-in, bogus Entra ID device-code pages, or fake update screens that drop CornFlake or ChocoShell malware. The tell: the login or device-code prompt comes as part of the guest Wi‑Fi flow, not from your normal Microsoft URL or bookmark. If hotel Wi‑Fi suddenly wants your work password or a device code, that’s CaptiveCrunch territory. When you travel, treat hotel and conference Wi‑Fi as hostile: if it ever asks for your Microsoft 365 password or a device code, stop, disconnect, and switch to VPN or your phone’s hotspot instead.
Microsoft says a Russia-linked group compromised hotel and venue Wi‑Fi captive portals to show convincing fake prompts during the normal “connect to Wi‑Fi” flow. The prompts try to trick travelers into installing malware, running commands, or approving a Microsoft sign-in that grants the attacker…
Attackers hijacked hotel/captive-portal Wi‑Fi infrastructure to redirect travelers to fake browser or operating system update pages and trick them into installing spyware. The operation (tracked as CaptiveCrunch) used DNS manipulation and user prompts (including “ClickFix” instructions) to get…
Google tracked three suspected Russia-linked groups running targeted phishing that abuses real login and authentication features (app passwords, OAuth, and device codes) to get into accounts. The lures often look like legitimate conference or diplomatic invitations, and some campaigns spoof…
Google says three suspected Russian cyber-espionage groups are running highly targeted phishing campaigns against people in government, academia, defense, and think tanks in the US and Europe. A key theme is abusing legitimate Google/Microsoft OAuth login flows so the outreach looks real, tricking…
Researchers observed real campaigns where a fake “AI crypto trading agent” website tricked victims into downloading malware that silently replaces browser wallet extensions and steals the wallet password when it’s typed. The same reporting also describes invoice emails using QR codes to push…
Researchers tied North Korea’s Lazarus Group to a real-world campaign that approaches professionals with convincing fake recruiter outreach and job offers. Victims are tricked into opening a malicious PDF or installing a fake PDF viewer from lookalike websites, which then installs backdoors and can…
