Microsoft says Russian-linked threat actors compromised hotel and conference guest Wi‑Fi “captive portal” networks to redirect travelers to fake Microsoft 365 sign-in pages, device-code phishing, or fake update pages. The goal was to steal cloud credentials (including Entra ID device codes) and trick victims into running malware under the guise of browser/OS updates.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You join hotel Wi‑Fi, and boom, before the internet even works, a perfect Microsoft 365 login pops up. Microsoft calls this campaign CaptiveCrunch. Compromised hotel and conference Wi‑Fi quietly hijack DNS and HTTP, then redirect you to fake Microsoft 365 sign-in, bogus Entra ID device-code pages, or fake update screens that drop CornFlake or ChocoShell malware. The tell: the login or device-code prompt comes as part of the guest Wi‑Fi flow, not from your normal Microsoft URL or bookmark. If hotel Wi‑Fi suddenly wants your work password or a device code, that’s CaptiveCrunch territory. When you travel, treat hotel and conference Wi‑Fi as hostile: if it ever asks for your Microsoft 365 password or a device code, stop, disconnect, and switch to VPN or your phone’s hotspot instead.
Microsoft says a Russia-linked group compromised hotel and venue Wi‑Fi captive portals to show convincing fake prompts during the normal “connect to Wi‑Fi” flow. The prompts try to trick travelers into installing malware, running commands, or approving a Microsoft sign-in that grants the attacker…
Attackers hijacked hotel/captive-portal Wi‑Fi infrastructure to redirect travelers to fake browser or operating system update pages and trick them into installing spyware. The operation (tracked as CaptiveCrunch) used DNS manipulation and user prompts (including “ClickFix” instructions) to get…
Microsoft reports a Russian state-backed operation that compromises hotel and conference Wi‑Fi “captive portals” to redirect travelers to fake Microsoft 365 sign-in pages or fake update prompts that install malware. One method abuses Microsoft’s device-code login flow so victims unknowingly approve…
Microsoft says a Russian-linked group is abusing hotel and conference Wi‑Fi “captive portals” to trick travelers into entering corporate credentials or installing malware. Victims see what looks like a normal Wi‑Fi login flow, but attackers manipulate DNS/website traffic to redirect them to fake…
Microsoft and ReliaQuest report a real campaign where Russian-linked hackers compromised hotel Wi‑Fi networks and redirected travelers to fake Microsoft login pages or fake update screens. The goal was to steal Microsoft 365 credentials and/or trick victims into installing espionage malware,…
Microsoft reports a real-world campaign where attackers tamper with Wi‑Fi captive portal traffic at hotels and similar venues to redirect travelers to attacker-controlled pages. Victims are pushed into fake Microsoft sign-ins (device code/OAuth phishing) or tricked into installing “browser/OS…
