Midnight Blizzard Hijacks Hotel Wi‑Fi to Phish Guests

Microsoft says a Russia-linked group compromised hotel and conference guest Wi‑Fi sign-in systems to redirect travelers to phishing pages and fake “update” prompts. The goal was to steal credentials (including Microsoft 365) and push malware when devices automatically check connectivity after joining a new network.

Key findings

• Attackers compromised captive portal equipment used for hotel/conference guest Wi‑Fi sign-in, active since early May 2026.
• Microsoft attributes the campaign (“CaptiveCrunch”) to Storm-2945, a sub-cluster of Russia-linked Midnight Blizzard (NOBELIUM/SVR attribution cited).
• From compromised network gear, victims were redirected to phishing infrastructure and shown malware disguised as browser/OS updates during automated connectivity checks after joining Wi‑Fi.
• The campaign included Microsoft 365 device code/OAuth phishing where victims are tricked into entering a code on a genuine Microsoft page, authenticating the attacker’s session.
• ReliaQuest observed compromised captive portals across multiple US cities, plus India and Saudi Arabia; impacted traffic came from many industries, suggesting traveling employees broadly were targeted.
• Some cases also attempted to abuse WPAD to expand redirection beyond authentication traffic.
• Microsoft recommends blocking Entra ID device code flow where not needed and using MFA/passkeys; both Microsoft and ReliaQuest advise treating guest Wi‑Fi as untrustworthy and using full-tunnel VPN or managed travel routers/hotspots.

Who’s being targeted

• Commonly targeted roles: All traveling employees, Executives, Sales, Consultants/Professional services staff, Finance, Legal, IT/Identity & Access Management.
• Affected industries: Hospitality (hotels, conference centres), Financial services, Professional services, Legal, Health care, Energy, Retail.
• Attack channels: website.
• Impersonated: Hotel or conference guest Wi‑Fi captive portal, Browser or operating system update prompt shown during Wi‑Fi connectivity checks, Microsoft device code authentication flow (legitimate Microsoft page, abused by attackers).

Awareness takeaways

• Treat hotel and conference guest Wi‑Fi as untrusted; avoid entering sensitive credentials when first joining a public network.
• Be suspicious of “update required” prompts that appear right after connecting to public Wi‑Fi; only update through official OS/app channels.
• If you see a Microsoft device-code sign-in you didn’t initiate, stop and report it, device codes can be used to sign attackers in.
• Use safer connectivity options for travel, like a full-tunnel VPN or a managed hotspot/travel router, instead of relying on venue Wi‑Fi.

Red flags to watch for

• Captive portal behaves unexpectedly (extra redirects or unusual pages)
• Sign-in page requests credentials unrelated to Wi‑Fi access
• You are prompted again after you already connected
• Update prompts appear immediately after connecting to public Wi‑Fi
• Updates are offered outside normal app store/OS update mechanisms
• The prompt appears in a captive portal or web page instead of system settings
• Unexpected request to use device code sign-in while joining Wi‑Fi
• A code is provided by a third-party page before you reach Microsoft
• Sign-in appears unrelated to any work device enrollment you initiated