Russian Hackers Are Targeting Hotel Wi-Fi to Steal Your Passwords. Russian spies have been turning hotel Wi-Fi networks into traps that unleash malware on unsuspecting guests.
Russian hackers, with links to a spy agency known as Midnight Blizzard, have been targeting people who connect to hotel and conference center Wi-Fi networks. The campaign has been dubbed CaptiveCrunch and appears to have been active since May 2026. As with most modern malware campaigns, the attackers’ goal is simple: infect devices and steal credentials. It’s a sophisticated operation and one which you need to be aware of.
Inside the Attack: What Actually Happens
We’ve all accessed a public Wi-Fi network, it’s easy and quick to do. There’s usually a page – known as a captive portal – which asks you to sign in or agree to a set of terms of use. And it’s this captive portal that the hackers are compromising. By hijacking this process, they can secretly reroute your traffic through their own servers. You still get normal internet access, but the attackers also get to spy on your every action.
Reports of how the attack unfolds have varied. Some people get redirected to fake Microsoft login pages, where the hackers steal the victims’ passwords. Other victims have been prompted to install browser updates or driver repair tools. Both are fake. Downloading them simply enables the attackers to install CornFlake, a powerful piece of malware which records keystrokes, takes screenshots and harvests saved passwords from browsers. This particular attack has also been accompanied by a download of ChocoShell, which steals browser cookies and Microsoft login tokens.
The campaign currently appears to be targeted at corporate travelers, journalists, and government staff, all of whom are likely to be carrying sensitive data on their devices. It’s also suspected that the hackers have used AI tools to help tailor and strengthen their attack. This has enabled them to quickly strengthen their campaign and evade detection.
Protecting Yourself from Unsecure Networks
The problem with public Wi-Fi is that it’s very difficult to confirm how secure it is. These networks are usually controlled by servers which are offsite, with even the owner of a hotel having little authority over them. Nonetheless, you can still keep yourself safe by following these best practices:
- Only Use Public Wi-Fi When Suitable: Instead of using public Wi-Fi networks, use your phone’s mobile data connection instead. If you do have to use public Wi-Fi, only use it for casual browsing and don’t enter any login details or sensitive information into it. And if you encounter any surprise pop-up windows, disconnect immediately.
- Be Suspicious of Prompts When You Connect: When you log on to a public network, alarm bells should start to ring if you’re immediately asked to install updates. This is especially suspicious if it occurs on a captive portal. If this does happen, the safest option once again is to disconnect.
- Use Two-Factor Authentication: One of the safest ways to protect your login credentials is with two-factor authentication. With this in place, even if your password is stolen, it requires a second verification step to be completed before access is granted. Apps such as Microsoft Authenticator or passkeys offer fantastic protection against these types of breaches.
For more ways to secure and optimize your business technology, contact your local IT professionals.
