Photo: GENYA SAVILOV / AFP / Getty Images
Microsoft has issued a security warning regarding a new cyber threat targeting hotel Wi-Fi networks, attributed to Russian hackers. The operation, named "CativeCrunch," involves hackers using phony sign-in pages to steal login credentials and infect devices with malware. This campaign, linked to the Russian espionage group Storm-2945, has been active since May and affects hospitality networks worldwide.
According to Fox News, hackers tamper with Wi-Fi equipment at hotels and conference centers, redirecting users to fake Microsoft 365 login pages. This poses a significant risk to business travelers, as the compromised network can appear normal, making the attack difficult to detect. The cybersecurity firm ReliaQuest reported compromised Wi-Fi gateways in several U.S. cities, targeting various industries, including financial services and healthcare.
Microsoft's warning highlights the use of AI by Storm-2945 to support the campaign. The hackers manipulate network traffic to display fake verification checks and software updates, tricking users into downloading malware. The malware, named CornFlake and ChocoShell, can steal credentials, record keystrokes, and capture audio and video.
The Record reported that the operation primarily targets corporate travelers, with hotels and other hospitality venues as the main focus. However, any organization using captive portal networks, such as airports and conference centers, could be at risk.
To protect against this threat, Microsoft advises travelers to treat public Wi-Fi networks as untrusted. Using a mobile hotspot, avoiding updates through captive portals, and employing phishing-resistant authentication are recommended. Additionally, disabling device-code authentication when not needed can help prevent unauthorized access.