Microsoft says a Russia-linked group compromised hotel and venue Wi‑Fi captive portals to show convincing fake prompts during the normal “connect to Wi‑Fi” flow. The prompts try to trick travelers into installing malware, running commands, or approving a Microsoft sign-in that grants the attacker access. Even if a laptop is later cleaned, stolen session tokens or device-code approvals can keep the attacker’s cloud access alive after the trip.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You’re in a hotel, you click “Connect to Wi‑Fi”… and the login page suddenly says you need a Windows or browser update to get online. Microsoft calls this CaptiveCrunch: compromised hotel Wi‑Fi portals that inject fake updates, ClickFix-style copy‑paste commands, or even a Microsoft sign‑in box that secretly approves the attacker’s session. Here’s the nasty part: joining the Wi‑Fi isn’t what gets you. It’s when you run their file, paste their command, or approve that device‑code sign‑in. That can give them cloud access that survives even after your laptop is wiped. Aha moment: hotel Wi‑Fi should NEVER ask you to install software or run commands. If it does, stop, disconnect, and report it, then use cellular or your VPN instead.
Attackers hijacked hotel/captive-portal Wi‑Fi infrastructure to redirect travelers to fake browser or operating system update pages and trick them into installing spyware. The operation (tracked as CaptiveCrunch) used DNS manipulation and user prompts (including “ClickFix” instructions) to get…
Microsoft says Russian-linked threat actors compromised hotel and conference guest Wi‑Fi “captive portal” networks to redirect travelers to fake Microsoft 365 sign-in pages, device-code phishing, or fake update pages. The goal was to steal cloud credentials (including Entra ID device codes) and…
Microsoft reports a Russian state-backed operation that compromises hotel and conference Wi‑Fi “captive portals” to redirect travelers to fake Microsoft 365 sign-in pages or fake update prompts that install malware. One method abuses Microsoft’s device-code login flow so victims unknowingly approve…
Microsoft says a Russian-linked group is abusing hotel and conference Wi‑Fi “captive portals” to trick travelers into entering corporate credentials or installing malware. Victims see what looks like a normal Wi‑Fi login flow, but attackers manipulate DNS/website traffic to redirect them to fake…
Microsoft and ReliaQuest report a real campaign where Russian-linked hackers compromised hotel Wi‑Fi networks and redirected travelers to fake Microsoft login pages or fake update screens. The goal was to steal Microsoft 365 credentials and/or trick victims into installing espionage malware,…
Microsoft reports a real-world campaign where attackers tamper with Wi‑Fi captive portal traffic at hotels and similar venues to redirect travelers to attacker-controlled pages. Victims are pushed into fake Microsoft sign-ins (device code/OAuth phishing) or tricked into installing “browser/OS…
